SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsreview-php

review-php

General & other

View repository

Updated 10-16 01:35

About this skill

Skill: Review PHP

Purpose

Only look at the code in PHP to understand language and runtime conventions. Do not define scope (diff vs codebase) or perform security/architecture analysis; these are handled by the scope and cognitive skills. Emit in the standard formatresult listfor aggregation. Focus on strict typing and declarations, error handling, resource management, PSR standards (PSR-4, PSR-12), namespaces, null safety, generators and iterables, PHP version compatibility, and testability.

Core Objective

Primary objective: Generate a PHP language/runtime result list covering strict typing, error handling, resource management, PSR standards, namespaces, null safety, generators, version compatibility, and testability for the given code scope.

Success criteria(all requirements must be met):

  1. ✅ PHP scope only: Only review PHP language and runtime conventions; no scope selection, security, or architecture analysis performed
  2. ✅ Cover all nine PHP dimensions: strict typing, error handling, resource management, PSR standards, namespaces/autoloading, null safety, generators/iterables, PHP version compatibility, and testability are evaluated (if relevant)
  3. ✅ Result format compatible: Each result includes location, category (language-php), severity, title, description, and optional recommendation
  4. ✅ file:line references: All findings reference a specific file location with line number
  5. ✅ Exclude non-PHP code: PHP-specific rules are not analyzed for non-PHP files unless explicitly in scope

Acceptance test: Does the output contain a PHP-focused result list with file:line references covering all relevant language/runtime dimensions without performing security, architecture, or scope analysis?

Scope boundaries (Scope boundaries)

This skill is responsible for：

  • declare(strict_types=1), typed properties, parameters, return types
  • Exception handling (Throwable hierarchy, try-catch-finally, no empty catch)
  • Resource management (fopen/fclose, database connections, try-finally patterns)
  • PSR-4 autoloading and PSR-12 coding style
  • Namespace and autoloading correctness
  • Null coalescing (??), null-safe operator (?->), avoiding error suppression
  • Correctness of generators and iterables
  • PHP version compatibility with composer.json constraints
  • Testability (DI, static/singleton avoidance, constructor injection)

This skill is not responsible for：

  • Scope selection—scope is provided by the caller
  • Security analysis (injection, authentication, CSRF)—use "review-security"
  • Architecture analysis—use "review-architecture"
  • SQL-specific analysis — use review-sql
  • Full orchestrated review—use "review-code"

Handoff point: After all PHP findings are emitted, hand them off to orchestrate-code-review for aggregation. For SQL injection or security vulnerabilities found in PHP code, note them and recommend "review-security".

Usage scenarios (Use cases)

  • Carefully scoped review: when orchestrate-code-review runs the PHP project's scope → language → framework → library → cognitive, used as the language step.
  • PHP-only review: when the user only wants to check language/runtime conventions (for example, after adding new PHP files).
  • Pre-PR PHP checklist: ensure type safety, resource cleanup, and PSR compliance are correct.

When to use: when the code being reviewed is PHP and the task includes language/runtime quality. The scope is determined by the caller or user.

Behavior (Behavior)

The scope of this skill

  • Analyze：the given code scopePHP language and runtime conventions in (the files or diff provided by the caller). Does not decide scope; accepts the code scope as input.
  • Do not: perform scope selection, security review, or architecture review; unless explicitly in scope, do not check PHP-specific rules in non-PHP files.

Review checklist (PHP dimensions only)

  1. Strict types and declarations：declare(strict_types=1) usage; typed properties and parameters; return type declarations; avoid implicit type coercion pitfalls.
  2. Error handling: exceptions and errors; Throwable hierarchy; correct try-catch and rethrow; avoid empty catches or overly broad catches; related 'error_reporting' and error-to-exception conversion.
  3. Resource management：fopen/fclose, database connections, streams; ensure resources are closed (try-finally or short-lived scopes); avoid resource leaks.
  4. PSR standards: PSR-4 autoloading and namespace-to-path mapping; PSR-12 coding style (indentation, braces, visibility); naming of classes and methods.
  5. Namespaces and autoloading: correctusestatements; avoid global namespace pollution; Composer autoload alignment.
  6. Null safety: null coalescing (??), nullsafe operator (?->); avoid '@' error suppression; 'isset' vs 'array_key_exists' for arrays.
  7. Generators and iteration: correctyieldusage; correct iterator implementations; memory-efficient iteration over large datasets.
  8. PHP version compatibility: features used vs the 'php' constraint in composer.json; deprecated APIs and migration paths.
  9. Testability: dependency injection; static and singleton usage; constructor injection; seams for mocking.

Tone and references

  • Professional and technical: reference specific locations (file:line). Emit results containing location, category, severity, title, description, recommendation.

Input & Output (Input & Output)

Input (Input)

  • Code scope: the file or directory (or diff) already selected by the user or scope skill. This skill does not decide scope; it only checks the language conventions of the provided PHP code.

Output (Output)

  • inAppendix: Output contractemit zero or more in the format defined inresults。
  • The category of this skill islanguage-php。

Limitations (Limitations)

Hard Boundaries

  • Do notperform security, architecture, or scope selection. Follow PHP language and runtime conventions.
  • Do notgive conclusions without concrete locations or actionable recommendations.
  • Do notcheck PHP-specific rules for non-PHP code unless explicitly in scope.

Skill Boundaries

Do not do these(other skills can handle them):

  • Do not select or define code scope - scope is determined by the caller or "review code"
  • Do not perform security analysis (SQL injection, XSS, CSRF) - use "review-security"
  • Do not perform architecture analysis - use "review-architecture"
  • Do not perform comprehensive SQL analysis — use review-sql

When to stop and hand off：

  • After all PHP findings are published, hand them off to "orchestrate-code-review" for aggregation
  • When the user needs a comprehensive review (scope + language + cognitive), redirect to "review code"
  • When SQL injection or security issues are found, note them and recommend "review security"

Self-Check

Core success criteria

  • PHP scope only: only review PHP language and runtime conventions; no scope selection, security, or architecture analysis performed
  • Covers all nine PHP dimensions: strict types, error handling, resource management, PSR standards, namespaces/autoloading, null safety, generators/iterables, PHP version compatibility, and testability (if relevant) are evaluated
  • Result format compatible: each result includes location, category (language-php), severity, title, description, and optional recommendation
  • file:line references: all results reference specific file locations with line numbers
  • Exclude non-PHP code: PHP-specific rules for non-PHP files are not analyzed unless explicitly in scope

Process quality checks

  • Were only PHP language/runtime dimensions reviewed (no scope/security/architecture)?
  • Were the relevant strict types, error handling, resources, PSR, namespaces, null safety, generators, version compatibility, and testability covered?
  • Does each finding include location, category=language-php, severity, title, description, and optional recommendation?
  • Does file:line reference the issue?

Acceptance tests

Does the output contain a PHP-centric results list with file:line references, covering all relevant language/runtime dimensions, without performing security, architecture, or scope analysis?

Examples

Example 1: Resource leak

  • Input: A PHP function that opens a file using "fopen()" and does not close the file in all code paths.
  • Expected: Emit a resource management finding; recommend try-finally or ensure "fclose()" in all paths. category = language-php.

Example 2: Missing strict types

  • Input: No declare(strict_types=1) and a new PHP file missing parameter/return types.
  • Expected: Emit type-safe results; recommend adding strict types and typed parameters where feasible. Category = language-php.

Edge case: mixed PHP and SQL

  • Input: PHP file with embedded SQL strings for database queries.
  • Expected: Review only PHP conventions (resource handling, error handling, types). Do not emit SQL injection findings here; that is for review-security or review-sql.