How do I install the PHP Antipatterns skill?

Run npx skillmds@latest add nledford/php-antipatterns in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is PHP Antipatterns safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with PHP Antipatterns?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is PHP Antipatterns free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published PHP Antipatterns?

nledford (@nledford) published this skill. Their other Agent Skills are listed on their SkillMD profile.

PHP Antipatterns by nledford — Agent Skill

Name: PHP Antipatterns
Author: nledford

PHP Antipatterns

Evidence-backed PHP smell review and refactoring guidance. Use when auditing or refactoring PHP for dynamic properties, magic accessors, weak types, global state, unsafe loading, injection risks, framework leakage, brittle tests, dependency sprawl, or PHP 8.4 migration smells. Do not use for ordinary implementation, pattern selection, or test execution; use php-engineering, php-design-patterns, or php-testing-quality instead.

nledford 25c83a9 3.4 KB Updated Sep 17, 2026

File contents

PHP Anti-Patterns

Use When

Use for focused PHP review or refactoring with code evidence and a plausible maintenance, correctness, or security consequence. Route implementation to php-engineering, positive design choices to php-design-patterns, and test lanes to php-testing-quality.

Generated Material Boundary

Treat generated, vendored, framework-cache, and dependency material as evidence, not refactoring targets. Establish ownership before proposing changes; route dependency provenance and executable Composer inputs to dependency-supply-chain-review.

Common Anti-Patterns

Look for dynamic-property bags, magic accessor overuse, associative-array domain models, weak or implicit types, loose comparison and truthiness traps, global/service-locator state, include-time side effects, broad exception swallowing, error suppression, unsafe eval/deserialization/file inclusion, and string-built SQL/HTML/JavaScript.

PHP 8.4 Migration Smells

Flag implicitly nullable declarations, property hooks with I/O or recursive/surprising behavior, assuming asymmetric visibility makes referenced objects transitively immutable, and upgrading to a PHP 8.4 feature without proving the supported runtime. Keep feature facts in php-84-migration.md, not in this review catalog.

Architecture And Method Smells

Flag framework/ORM leakage into domain policy, generic CRUD repositories, inheritance-heavy abstractions, service bags, wrappers with no invariant or substitution seam, and transaction or resource ownership split across layers.

Template And Framework Smells

Flag controllers that build HTML, templates that implement policy, raw data crossing into executable JavaScript, and framework globals entering domain logic. Use context-aware encoding and explicit render data instead. Recognize host-required entry guards, including Piwigo direct-entry guards, rather than flagging them generically.

Test Smells

Flag excessive mocks, nondeterministic fixtures, shared process globals, tests coupled to private plumbing, and static-analysis or syntax-only checks presented as behavioral proof.

Refactoring Prompts

Ask what invariant, boundary, or observable behavior the code protects. Replace bags with typed values, loose comparisons with explicit intent, globals with injected dependencies, and string construction with structured APIs. Keep changes small and migrate every caller.

Reporting Rules

Report only evidence-backed findings: location, concrete path to failure or maintenance cost, severity proportionate to impact, and a smallest safe correction. Do not report style preference as a defect. Use code-review and review-verification-protocol for reported findings.

---name: php-antipatternsdescription: Evidence-backed PHP smell review and refactoring guidance. Use when auditing or refactoring PHP for dynamic properties, magic accessors, weak types, global state, unsafe loading, injection risks, framework leakage, brittle tests, dependency sprawl, or PHP 8.4 migration smells. Do not use for ordinary implementation, pattern selection, or test execution; use php-engineering, php-design-patterns, or php-testing-quality instead.---# PHP Anti-Patterns## Use WhenUse for focused PHP review or refactoring with code evidence and a plausible maintenance, correctness, or security consequence. Route implementation to [`php-engineering`](../php-engineering/SKILL.md), positive design choices to [`php-design-patterns`](../php-design-patterns/SKILL.md), and test lanes to [`php-testing-quality`](../php-testing-quality/SKILL.md).## Generated Material BoundaryTreat generated, vendored, framework-cache, and dependency material as evidence, not refactoring targets. Establish ownership before proposing changes; route dependency provenance and executable Composer inputs to [`dependency-supply-chain-review`](../dependency-supply-chain-review/SKILL.md).## Common Anti-PatternsLook for dynamic-property bags, magic accessor overuse, associative-array domain models, weak or implicit types, loose comparison and truthiness traps, global/service-locator state, include-time side effects, broad exception swallowing, error suppression, unsafe `eval`/deserialization/file inclusion, and string-built SQL/HTML/JavaScript.## PHP 8.4 Migration SmellsFlag implicitly nullable declarations, property hooks with I/O or recursive/surprising behavior, assuming asymmetric visibility makes referenced objects transitively immutable, and upgrading to a PHP 8.4 feature without proving the supported runtime. Keep feature facts in [`php-84-migration.md`](../php-engineering/references/php-84-migration.md), not in this review catalog.## Architecture And Method SmellsFlag framework/ORM leakage into domain policy, generic CRUD repositories, inheritance-heavy abstractions, service bags, wrappers with no invariant or substitution seam, and transaction or resource ownership split across layers.## Template And Framework SmellsFlag controllers that build HTML, templates that implement policy, raw data crossing into executable JavaScript, and framework globals entering domain logic. Use context-aware encoding and explicit render data instead. Recognize host-required entry guards, including Piwigo direct-entry guards, rather than flagging them generically.## Test SmellsFlag excessive mocks, nondeterministic fixtures, shared process globals, tests coupled to private plumbing, and static-analysis or syntax-only checks presented as behavioral proof.## Refactoring PromptsAsk what invariant, boundary, or observable behavior the code protects. Replace bags with typed values, loose comparisons with explicit intent, globals with injected dependencies, and string construction with structured APIs. Keep changes small and migrate every caller.## Reporting RulesReport only evidence-backed findings: location, concrete path to failure or maintenance cost, severity proportionate to impact, and a smallest safe correction. Do not report style preference as a defect. Use [`code-review`](../code-review/SKILL.md) and [`review-verification-protocol`](../review-verification-protocol/SKILL.md) for reported findings.

Frequently asked questions