Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/trebormc/drupal-ai-agentsnpx agentmods add skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolutionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolution)<a href="https://agentmods.dev/skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolution"><img src="https://agentmods.dev/badge/skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolution/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolution"><img src="https://agentmods.dev/badge/skills/trebormc/drupal-ai-agents/phpstan-phpcs-conflict-resolution.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00204 | $0.01235 |
| Opus 5.5 | $0.00082 | $0.00494 |
| Sonnet 5.5 | $0.00041 | $0.00247 |
| Haiku 4.5 | $0.00020 | $0.00123 |
Grade A, and why
phpstan-phpcs-conflict-resolution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PHPStan ↔ PHPCS Conflict Resolution
When both tools flag the same line they can demand OPPOSITE changes. Fixing one then
re-triggers the other — an infinite alternation. This skill encodes the resolutions
that survive BOTH tools at zero, plus the suppression mechanics that make
@phpstan-ignore behave. All commands via ssh web.
Golden rule
Determine which tool's complaint reflects a REAL contract (read the code that calls or implements the line). Satisfy that one; suppress the OTHER as narrowly as possible with a comment stating why. Alternate-fixing without this analysis is the failure mode this skill exists to prevent.
Recipe 1 — Hook docblocks: "no @param" vs "type the array"
Coder warns "Hook implementations should not duplicate @param/@return"; PHPStan level 8
raises missingType.iterableValue on the same hooks. {@inheritdoc} does NOT satisfy
PHPStan (procedural hooks inherit nothing). Core's approach wins: remove the docs, ignore
the rule for hook files in phpstan.neon:
ignoreErrors:
-
identifier: missingType.iterableValue
paths: ['*.module', '*.install', '*.theme']
phpstan-drupal DOES analyze .module/.install/.theme (it extends fileExtensions), so run
a targeted analyse to confirm the ignore matches — do not assume they are excluded.
Recipe 2 — Native type hints vs mockability
Narrowing object $x to a concrete class (e.g. \Drupal\Core\Extension\Extension)
silences PHPStan method.notFound but throws TypeError in unit tests that inject
anonymous-class mocks. Keep the native object; suppress per call line with a targeted
// @phpstan-ignore method.notFound. Never let a static-analysis pass change a runtime
signature that tests depend on. Run the unit suite after every PHPStan batch.
Recipe 3 — By-reference docblock variance
Two methods sharing a by-ref accumulator MUST declare the identical array type, or the
wider one re-widens the variable between iterations and the stricter one errors at the
call site. Overriding ConfigFormBase::validateForm() with @param array<string, mixed> $form
conflicts with the parent's plain array by-ref contract — array<mixed> satisfies both
missingType and variance.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 102 lines · 204 tokens per session scan A f8bdafb21304
phpstan-phpcs-conflict-resolution is a skill published in the GitHub repository trebormc/drupal-ai-agents (11 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 204 tokens to every session and 1,235 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sentry-php-sdk
Full Sentry SDK setup for PHP. Use when asked to "add Sentry to PHP", "install sentry/sentry", "setup Sentry in PHP", or configure error monitoring, tracing, profiling, logging, metrics, crons, or AI monitoring for PHP applications. Supports plain PHP, Laravel, and Symfony.
wp-phpstan-static-analysis
Run PHPStan static analysis on a WordPress plugin or theme using szepeviktor/phpstan-wordpress. Covers the composer dev-dependencies and what is pulled transitively (phpstan/phpstan ^2.0, php-stubs/wordpress-stubs), the optional phpstan/extension-installer that auto-registers the extension, the phpstan.neon.dist…
php-quality-tooling
Use when setting up PHPStan, Rector, or PHP-CS-Fixer on a non-Laravel PHP project, incl. CI wiring. Do NOT use for Laravel (Pint/Larastan), tests, or syntax.
wp-phpstan
Use when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and handling third-party plugin classes.
bug-root-cause-finder
Root cause analysis methods for PHP bugs. Provides 5 Whys technique, fault tree analysis, git bisect guidance, and stack trace parsing.
check-cascading-failures
Detects cascading failure risks in PHP systems. Identifies shared resources, unbounded queues, missing backpressure, thread pool exhaustion, and failure propagation paths.