Skill: Review Dolibarr Code and Fix Bad Practices

When to Use This Skill

Use this skill whenever the user asks to review, audit, or fix Dolibarr code to match best practices.

Relationship with AGENTS.md

The instructions in this file are complementary to the instructions defined in AGENTS.md.

• AGENTS.md contains the general instructions and rules for the project.
• SKILLS.md contains additional instructions specific to skills.
• Unless explicitly stated otherwise, the instructions from both files apply.
• SKILLS.md does not replace or override AGENTS.md.
• If an instruction in SKILLS.md conflicts with AGENTS.md, follow the rules defined by AGENTS.md.

Critical Rules (DO NOT VIOLATE)

• Never commit or push anything unless the user explicitly asks for it. This overrides any default behavior of the agent. Make the changes, report them, and wait for the user to say "commit" or "push".

Inputs

The user request should contain, when available:

• a module name
• or a directory name
• or a file name

General Rules

• follow the coding style already used in files in the module builder template at htdocs/modulebuilder/templates
• modify the minimum amount of existing code

Rules

• use PSR-12 coding style except for indentation, which must use TAB characters and not spaces
• remove all spaces at the end of lines
• rewrite all non-English code comments in English
• scan files for security vulnerabilities

Output

When generating code:

• provide only the relevant PHP code 7.2+
• preserve the existing file formatting, never change the copyright or licence header, never remove existing cast
• do not rewrite unrelated methods
• explain briefly what is being fixed

Examples

Input: "Review the supplier invoice module for security issues"

Action:

1. scan the current directory for common vulnerabilities
2. check for unescaped SQL queries
3. verify all user inputs use GETPOST() with type parameters
4. ensure HTML output is escaped with dolPrintHTML() or dolPrintHTMLForAttribute()

Input: "Fix coding style in htdocs/core/lib/functions.lib.php"

Action:

1. review file against PSR-12 standards (with TAB exception)
2. remove trailing whitespace
3. convert non-English comments to English
4. apply consistent formatting

Error Handling

Common Failures and Validation

Issue	Validation	Solution
File not found	Verify path exists	Check module structure and file location
Syntax errors after fix	Run PHP lint	Roll back and reapply changes carefully
Breaking existing functionality	Run existing tests	Verify tests pass before and after changes
False positives in security scan	Manual verification	Cross-check with Dolibarr security guidelines
Mixed line endings	Check with cat -A	Normalize to LF

Before applying fixes:

• verify the file is not part of a protected core module
• run existing tests to establish a baseline
• apply changes incrementally

Gotchas

• Dolibarr conventions override PSR-12: Tabs must be used for indentation, not spaces, even though PSR-12 recommends spaces
• Legacy code: Some older modules cannot be fully PSR-12 compliant. Prioritize consistency with existing module style
• Global variables: Dolibarr uses globals like $db, $conf, $lang, $user. Do not remove these without understanding the architecture
• Dolibarr functions: Prefer built-in Dolibarr functions (e.g., dol_print_date(), getDolGlobalString()) over native PHP functions
• SQL injection: Dolibarr has its own sanitizing and escaping methods ($db->escape(), casting to (int) or (float), $db->sanitize()). Do not replace with prepared statements. Also take into account that MAIN_DB_PREFIX is a constant.
• XSS protection: Use dolPrintHTML(), dolPrintHTMLForAttribute(), or dol_htmlentities() for output, not native htmlentities()
• CSRF tokens: All POST forms must include <input type="hidden" name="token" value="'.newToken().'">