# Botble Code Review

> Review Botble CMS code for correctness, security, Envato marketplace readiness, enum bugs, XSS, CSRF, CDN usage, BaseModel violations, inline JS/CSS, translation mistakes, N+1 queries, migration issues, and Botble-specific table, form, badge, media, and ecommerce pitfalls.

- Skill: `zakblacki/botble-code-review` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add zakblacki/botble-code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakblacki/botble-code-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: zakblacki (https://skillmd.com/u/zakblacki)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/zakblacki/botble-code-review

---


# Botble Code Review

Review with a bug-first stance. Findings must be actionable, scoped, and grounded in file and line references when available.

## Severity

Critical:

- Botble enum comparisons without `getValue()` or string cast.
- `{!! !!}` output without `BaseHelper::clean()`.
- CDN assets such as googleapis, jsdelivr, unpkg, or cdnjs.
- SQL injection, missing CSRF protection, or unsafe cookie access.

High:

- Models not extending `BaseModel`.
- Inline JavaScript/CSS.
- Dead code, commented-out code, or avoidable duplication.
- Views over roughly 150 lines or controllers over roughly 200 lines when complexity is not split.

Medium:

- Raw ID parameters not typed as `int|string` when implicit route model binding is not used.
- Hardcoded user-facing strings.
- `bigInteger` or `unsignedBigInteger` foreign keys instead of `foreignId()`.
- Cookie reads without allowlist validation.
- N+1 queries from missing eager loads.

Low:

- Missing `Model::query()`.
- `setInterval` without cleanup.
- Noisy comments.

## Envato Marketplace Checks

- No CDN assets; bundle dependencies locally.
- No hardcoded license checks.
- All user-facing strings are translatable.
- No hidden external calls or remote asset dependencies.

## Botble-Specific Checks

- Badge classes pair `bg-{color}` with `text-{color}-fg`.
- Custom table rendering uses `FormattedColumn::make()`.
- Product eager loading includes both `image` and `images` when image accessors need them.
- Plugin `removed()` drops all plugin tables and cleans all plugin settings.
- Plugin translations use `trans()`, not `__()`.
- Media paths render through `RvMedia::getImageUrl()`.
- New modules use `vite.build.mjs`, not legacy `webpack.mix.js`; production builds use `npm run production`, and no Vite watch/dev-server workflow is documented.
- Treat trusted framework renderers such as `RvMedia::image()` and `Theme::partial()` separately from user-controlled raw HTML when reviewing `{!! !!}` output.

## Output

Lead with findings ordered by severity. If there are no findings, say so and mention residual test or coverage risk.

## Load References

Read `references/review-checklist.md` when doing a full pass.