Agent Skills
› Dolibarr/dolibarr
› skill-doli-code-review
skill-doli-code-review
GitHub用于审查和修复Dolibarr PHP代码，确保符合PSR-12编码规范及安全最佳实践。支持审计、修复漏洞及代码风格调整，适用于Dolibarr模块开发场景。
Trigger Scenarios
用户要求审查或审计Dolibarr代码
用户请求修复代码质量问题或安全漏洞
提及PSR-12合规性或代码规范检查
Install
npx skills add Dolibarr/dolibarr --skill skill-doli-code-review -g -y
SKILL.md
Frontmatter
{
"name": "skill-doli-code-review",
"license": "MIT",
"description": "Reviews Dolibarr PHP code for compliance with coding standards and security best practices, and fixes identified issues. Use when the user asks to review, audit, fix, or update code for Dolibarr, or mentions code quality, security vulnerabilities, or PSR-12 compliance.",
"allowed-tools": [
"read_file",
"write_file",
"grep"
],
"user-invocable": true
}
Skill: Review Dolibarr Code and Fix Bad Practices
When to Use This Skill
Use this skill whenever the user asks to review, audit, or fix Dolibarr code to match best practices.
Inputs
The user request should contain, when available:
- a module name
- or a directory name
- or a file name
General Rules
- follow the coding style already used in files in the module builder template at
htdocs/modulebuilder/templates - modify the minimum amount of existing code
Rules
- use PSR-12 coding style except for indentation, which must use TAB characters and not spaces
- remove all spaces at the end of lines
- rewrite all non-English code comments in English
- scan files for security vulnerabilities
Output
When generating code:
- provide only the relevant PHP code 7.2+
- preserve the existing file formatting, never change the copyright or licence header, never remove existing cast
- do not rewrite unrelated methods
- explain briefly what is being fixed
Examples
Input: "Review the supplier invoice module for security issues"
Action:
- scan the current directory for common vulnerabilities
- check for unescaped SQL queries
- verify all user inputs use
GETPOST()with type parameters - ensure HTML output is escaped with
dolPrintHTML()ordolPrintHTMLForAttribute()
Input: "Fix coding style in htdocs/core/lib/functions.lib.php"
Action:
- review file against PSR-12 standards (with TAB exception)
- remove trailing whitespace
- convert non-English comments to English
- apply consistent formatting
Error Handling
Common Failures and Validation
| Issue | Validation | Solution |
|---|---|---|
| File not found | Verify path exists | Check module structure and file location |
| Syntax errors after fix | Run PHP lint | Roll back and reapply changes carefully |
| Breaking existing functionality | Run existing tests | Verify tests pass before and after changes |
| False positives in security scan | Manual verification | Cross-check with Dolibarr security guidelines |
| Mixed line endings | Check with cat -A |
Normalize to LF |
Before applying fixes:
- verify the file is not part of a protected core module
- run existing tests to establish a baseline
- apply changes incrementally
Gotchas
- Dolibarr conventions override PSR-12: Tabs must be used for indentation, not spaces, even though PSR-12 recommends spaces
- Legacy code: Some older modules cannot be fully PSR-12 compliant. Prioritize consistency with existing module style
- Global variables: Dolibarr uses globals like
$db,$conf,$lang,$user. Do not remove these without understanding the architecture - Dolibarr functions: Prefer built-in Dolibarr functions (e.g.,
dol_print_date(),getDolGlobalString()) over native PHP functions - SQL injection: Dolibarr has its own sanitizing and escaping methods (
$db->escape(), casting to(int)or(float),$db->sanitize()). Do not replace with prepared statements. Also take into account that MAIN_DB_PREFIX is a constant. - XSS protection: Use
dolPrintHTML(),dolPrintHTMLForAttribute(), ordol_htmlentities()for output, not nativehtmlentities() - CSRF tokens: All POST forms must include
<input type="hidden" name="token" value="'.newToken().'">
Version History
- fe37cd8 Current 2026-08-27 18:03
