Install
$ agentstack add skill-chrisrowe-craftcms-claude-skills-craft-php-guidelines ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Craft CMS 5 PHP Guidelines
Complete PHP coding standards and conventions for active coding sessions.
Common Pitfalls
addSelect()is the convention inbeforePrepare()— safely additive when multiple extensions contribute columns. Craft's**placeholder merges defaults regardless, butaddSelect()prevents conflicts.$_instancesis not a Craft convention — private properties use underscore prefix but meaningful names like$_items,$_sections.- Records use the same class name as models (namespace distinguishes). Alias when importing both:
use ...\records\MyEntity as MyEntityRecord;. - Queue jobs have no "Job" suffix —
ResaveElements, notResaveElementsJob. declare(strict_types=1)is NOT used in plugin source files. Only in standalone config files likeecs.php.@authorgoes on classes and methods only — never on properties.- Don't use
string|null— use?string(short nullable notation). - Forget
parent::defineRules()and you lose all inherited validation. DateTimeHelperin elements/queries,Carbonin services — never mix in the same class.- Missing
@throwschains — document exceptions from called methods too, not just your own throws.
Documentation
- Official coding guidelines: https://craftcms.com/docs/5.x/extend/coding-guidelines.html
- Class reference: https://docs.craftcms.com/api/v5/
- Generator reference: https://craftcms.com/docs/5.x/extend/generator.html
When unsure about a convention, web_fetch the coding guidelines page for the authoritative answer.
Critical Rules
- PHPDocs on everything: classes, methods, properties. No exceptions.
@throwschains: document every exception including uncaught from called methods.@authorand@sinceat the bottom of class/method docblocks, after a blank line.- Section headers with
// =========================================================================on every class. declare(strict_types=1)is NOT used in plugin source files.- Private methods/properties prefixed with underscore:
_registerCpUrlRules(),$_items. addSelect()convention inbeforePrepare()(additive across extensions).DateTimeHelperin elements/queries,Carbonin services.- Always scaffold with
ddev craft make --with-docblocks, then customize. ddev composer check-csandddev composer phpstanmust pass before every commit.
Section Header Order
// Traits
// Const Properties
// Static Properties
// Public Properties
// Protected Properties
// Private Properties
// Public Methods
// Protected Methods
// Private Methods
Only include sections that have content. Blank line after the separator, before the first item.
Naming Quick-Reference
- Services (resource): Plural —
Entries,Volumes,Users - Services (utility): Domain noun —
Auth,Search,Gc - Queue jobs: Action verb, no suffix —
ResaveElements,UpdateSearchIndex - Records: Same name as model — namespace distinguishes
- Events: Three patterns —
SectionEvent,RegisterUrlRulesEvent,DefineHtmlEvent - Element actions: Action verb, no suffix —
Delete,Duplicate,SetStatus - Enums: PascalCase cases, string/int backed —
PropagationMethod,CmsEdition
Verification Checklist
Before every commit:
ddev composer check-cspassesddev composer phpstanpasses- Tests green
- PHPDocs complete on all new/modified code
@throwschains verified- Section headers present and correct
- Imports alphabetical and grouped
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: chrisrowe
- Source: chrisrowe/craftcms-claude-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.