Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add krzysztofsurdy/code-virtuoso --skill php-qualitygit clone --depth 1 https://github.com/krzysztofsurdy/code-virtuosoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/php-quality)<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/php-quality"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/php-quality/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/php-quality"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/php-quality.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.03199 |
| Opus 5.5 | $0.00032 | $0.01280 |
| Sonnet 5.5 | $0.00016 | $0.00640 |
| Haiku 4.5 | $0.00008 | $0.00320 |
Grade A, and why
php-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PHP quality
Three kinds of stale advice cause most bad PHP tooling setups: "PHPStan level 9 is the maximum", "follow PSR-12", and "use Rector for everything". Level 10 has existed since PHPStan 2.0. PER Coding Style now extends and replaces PSR-12. Rector has quality sets that are separate from the upgrade sets. This skill gives the current facts, a decision for each tool choice, and the idioms the model tends to miss or misuse. Version upgrades are out of scope: use php-upgrade.
Decide first
| Question | Answer | Why |
|---|---|---|
| Which static analyzer for a new project? | PHPStan | Official extensions cover Symfony, Doctrine and PHPUnit, and Rector itself depends on PHPStan (extensions) |
| Project already uses Psalm and it works? | Keep it | Switching costs more than it returns. Psalm is maintained, see Psalm vs PHPStan |
| Need taint analysis for injection paths? | Psalm, with --taint-analysis |
It is a Psalm feature (error levels). The PHPStan docs read for this skill list none |
| Which formatter for a new project? | PHP-CS-Fixer with @PER-CS3x0 |
Ships PER-CS rule sets and fixes files in place |
| Project already has a PHP_CodeSniffer standard? | Keep PHPCS as the single formatter | Two tools fighting over whitespace produce endless diffs |
| Which coding style target? | PER-CS, not PSR-12 | See PER-CS and PSR-12 |
| Which Rector sets for quality? | Level methods, raised one step per PR | See Rector for quality |
| Legacy code with thousands of errors? | Lower level plus a baseline, or fix by directory | See Baseline strategy |
PHPStan
Levels are cumulative. Level 0 checks unknown symbols and argument counts, 5 checks argument types, 6 checks missing type hints, 8 checks nullable access, 9 is strict about explicit mixed, and 10 (new in 2.0) also flags implicit mixed, such as missing types from third-party code. The full list is on rule-levels. Details, config samples, extensions and generics are in phpstan.md.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 147 lines · 81 tokens per session scan A a1b546d15659
php-quality is a skill published in the GitHub repository krzysztofsurdy/code-virtuoso (36 stars, last pushed yesterday), licensed MIT. It adds 81 tokens to every session and 3,199 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-23.
Other skills, from other repositories
wp-phpcs-coding-standards
Set up and run PHPCodeSniffer with the WordPress Coding Standards (WPCS) and PHPCompatibility on a plugin or theme. Covers the composer dev-dependencies and their exact (and confusingly-named) packages — squizlabs/phpcodesniffer, wp-coding-standards/wpcs, phpcompatibility/phpcompatibility-wp…
resharper-clt
Use the free official JetBrains ReSharper Command Line Tools for .NET repositories. USE FOR: jb inspectcode; jb cleanupcode; stronger C# inspections, cleanup profiles, and CI-friendly JetBrains analysis. DO NOT USE FOR: replacing tests with inspection output; ad-hoc formatting-only work when the repo intentionally…
roslynator
Use the open-source free Roslynator analyzer packages and optional CLI for .NET. USE FOR: Roslynator.Analyzers setup; Roslynator CLI checks or cleanup; C# linting, static analysis, and code-fix automation. DO NOT USE FOR: overlapping analyzer packs with no consolidation plan; formatting-only work owned by another…
stylecop-analyzers
Use the open-source free StyleCop.Analyzers package for naming, layout, documentation, and style rules in .NET projects. Use when a repo wants stricter style conventions than the SDK analyzers alone provide. USE FOR: the repo wants StyleCop.Analyzers; naming, layout, or documentation style needs stronger enforcement…
mvc-expert
Expert guidelines to refactor legacy PHP codebases into clean, modern, and scalable MVC-structured projects / Pedoman ahli untuk merefaktor codebase PHP lama menjadi proyek terstruktur MVC yang bersih, modern, dan skalabel.
yao-geoflow-template
Use only for explicit legacy GEOFlow template skill questions, old PHP template-package contracts, or historical outputs using root index.php/article.php/category.php/archive.php and includes/.php. Route current Laravel Blade themes, reference-site cloning, homepage modules, leadform, theme editor, channel frontend…