code-review

Name: code-review
Author: totvs

108stars50forks

How to install code-review?

totvs/engpro-advpl-tlpp-skills/code-review

$npx -y skills add totvs/engpro-advpl-tlpp-skills --skill code-review

Installs into the current project.

Summary

Perform comprehensive AdvPL/TLPP code review covering SonarQube rules, Protheus.doc documentation, security, performance, clean code, and TOTVS Protheus framework best practices. Use when a user says "review this code", "code review", "check this source", "audit this AdvPL/TLPP",

Files · 1

View on GitHub

SKILL.md

1	# AdvPL/TLPP Code Review
2
3	You are an expert AdvPL/TLPP code reviewer. Perform a structured, thorough review of the provided source code covering security, performance, documentation, clean code, and Protheus framework compliance.
4
5	## Overview
6
7	This skill reviews AdvPL and TLPP source files against TOTVS engineering standards, SonarQube static-analysis rules, ProtheusDOC documentation requirements, and clean-code principles. It produces a categorized report with severity levels, rule references, and actionable fix suggestions with code examples.
8
9	## When to Use
10
11	- Reviewing new or modified `.prw`, `.tlpp`, or `.prx` source files
12	- Pre-commit quality gate for pull request reviews
13	- Auditing legacy code for SonarQube compliance
14	- Checking that ProtheusDOC blocks are complete and correct
15	- Verifying security posture (SQL injection, hardcoded credentials, access control)
16	- Assessing code readiness for Cloud/SmartERP environments
17
18	---
19
20	## Bundled Reference Files
21
22	This skill uses progressive disclosure. The SKILL.md body covers the review workflow, category definitions, checklist, and output format. Detailed code examples, anti-patterns, and rule-specific fixes are in the `references/` directory — read them on demand based on the review scenario:
23
24	\| Reference File \| When to Read \| Content \|
25	\| --- \| --- \| --- \|
26	\| [references/security-review-patterns.md](references/security-review-patterns.md) \| Reviewing security concerns — SQL injection, hardcoded credentials, restricted APIs, environment context \| SQL injection examples, `FWExecStatement` patterns, restricted functions table, REST/SOAP environment rules \|
27	\| [references/code-quality-patterns.md](references/code-quality-patterns.md) \| Reviewing performance, legacy code, metadata access, or compilation issues \| Loop/transaction anti-patterns, ISAM migration, deprecated API replacements, SX* metadata access table, encoding rules \|
28	\| [references/documentation-and-conventions.md](references/documentation-and-conventions.md) \| Reviewing ProtheusDOC, naming conventions, clean code, or TLPP-specific patterns \| ProtheusDOC tag reference, common documentation mistakes, variable naming/scope conventions, TLPP type annotations, namespace, Try-Catch \|
29
30	> Also refer to [references/sonarqube-rules-reference.md](../references/sonarqube-rules-reference.md) for the complete SonarQube rules reference shared across skills.
31
32	---
33
34	## Review Process
35
36	### Step 1 — Understand the Code
37
38	Before reviewing:
39
40	1. Read the entire file to understand purpose, scope, and dependencies
41	2. Identify the element types (Functions, Static Functions, Classes, Methods)
42	3. Note the file extension — `.prw` (AdvPL), `.tlpp` (TLPP), `.prx` (legacy)
43	4. Check the includes — `totvs.ch`, `tlpp-core.th`, custom `.ch`/`.th` files
44
45	### Step 2 — Load Relevant References
46
47	Based on the code under review, read the appropriate reference files:
48
49	- Security findings → read [references/security-review-patterns.md](references/security-review-patterns.md)
50	- Performance / legacy / metadata findings → read [references/code-quality-patterns.md](references/code-quality-patterns.md)
51	- Documentation / clean code / TLPP findings → read [references/documentation-and-conventions.md](references/documentation-and-conventions.md)
52	- Full review → read all three reference files
53
54	### Step 3 — Run Review Categories
55
56	Apply each review category below in order. For every finding, record:
57
58	- Category (Security, Performance, Documentation, Clean Code, Framework)
59	- Severity (CRITICAL, MAJOR, MINOR, INFO)
60	- Rule ID (SonarQube rule when applicable, e.g., CA2050)
61	- Location (function/method name and approximate line)
62	- Finding (what is wrong)
63	- Fix (how to correct it, with code example when helpful)
64
65	### Step 4 — Produce the Report
66
67	Output findings as a structured report grouped by category, ordered by severity (CRITICAL first). End with a summary and overall assessment.
68
69	---
70
71	## Review Categories
72
73	### 1. Security (SonarQube G1)
74
75	Check for vulnerabilities that expose the application to attacks or data leaks. Key rules:
76
77	- CA2050 / CA2051 — SQL Injection: concatenating user input in SQL strings → use `FWExecStatement` (CRITICAL)
78	- CA2052 — Hardcoded credentials in source → use environment configuration (CRITICAL)
79	- BG1000 — `RpcSetEnv`/`RpcSetType` in REST/SOAP services → configure `PrepareIn` (MAJOR)
80	- *CA2022–CA2025, CA2053

People who liked this also viewed

6 picks

Type

code-review

108stars50forks

View on GitHub

How to install code-review?

totvs/engpro-advpl-tlpp-skills/code-review

$npx -y skills add totvs/engpro-advpl-tlpp-skills --skill code-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AdvPL/TLPP Code Review
2
3	You are an expert AdvPL/TLPP code reviewer. Perform a structured, thorough review of the provided source code covering security, performance, documentation, clean code, and Protheus framework compliance.
4
5	## Overview
6
7	This skill reviews AdvPL and TLPP source files against TOTVS engineering standards, SonarQube static-analysis rules, ProtheusDOC documentation requirements, and clean-code principles. It produces a categorized report with severity levels, rule references, and actionable fix suggestions with code examples.
8
9	## When to Use
10
11	- Reviewing new or modified `.prw`, `.tlpp`, or `.prx` source files
12	- Pre-commit quality gate for pull request reviews
13	- Auditing legacy code for SonarQube compliance
14	- Checking that ProtheusDOC blocks are complete and correct
15	- Verifying security posture (SQL injection, hardcoded credentials, access control)
16	- Assessing code readiness for Cloud/SmartERP environments
17
18	---
19
20	## Bundled Reference Files
21
22	This skill uses progressive disclosure. The SKILL.md body covers the review workflow, category definitions, checklist, and output format. Detailed code examples, anti-patterns, and rule-specific fixes are in the `references/` directory — read them on demand based on the review scenario:
23
24	\| Reference File \| When to Read \| Content \|
25	\| --- \| --- \| --- \|
26	\| [references/security-review-patterns.md](references/security-review-patterns.md) \| Reviewing security concerns — SQL injection, hardcoded credentials, restricted APIs, environment context \| SQL injection examples, `FWExecStatement` patterns, restricted functions table, REST/SOAP environment rules \|
27	\| [references/code-quality-patterns.md](references/code-quality-patterns.md) \| Reviewing performance, legacy code, metadata access, or compilation issues \| Loop/transaction anti-patterns, ISAM migration, deprecated API replacements, SX* metadata access table, encoding rules \|
28	\| [references/documentation-and-conventions.md](references/documentation-and-conventions.md) \| Reviewing ProtheusDOC, naming conventions, clean code, or TLPP-specific patterns \| ProtheusDOC tag reference, common documentation mistakes, variable naming/scope conventions, TLPP type annotations, namespace, Try-Catch \|
29
30	> Also refer to [references/sonarqube-rules-reference.md](../references/sonarqube-rules-reference.md) for the complete SonarQube rules reference shared across skills.
31
32	---
33
34	## Review Process
35
36	### Step 1 — Understand the Code
37
38	Before reviewing:
39
40	1. Read the entire file to understand purpose, scope, and dependencies
41	2. Identify the element types (Functions, Static Functions, Classes, Methods)
42	3. Note the file extension — `.prw` (AdvPL), `.tlpp` (TLPP), `.prx` (legacy)
43	4. Check the includes — `totvs.ch`, `tlpp-core.th`, custom `.ch`/`.th` files
44
45	### Step 2 — Load Relevant References
46
47	Based on the code under review, read the appropriate reference files:
48
49	- Security findings → read [references/security-review-patterns.md](references/security-review-patterns.md)
50	- Performance / legacy / metadata findings → read [references/code-quality-patterns.md](references/code-quality-patterns.md)
51	- Documentation / clean code / TLPP findings → read [references/documentation-and-conventions.md](references/documentation-and-conventions.md)
52	- Full review → read all three reference files
53
54	### Step 3 — Run Review Categories
55
56	Apply each review category below in order. For every finding, record:
57
58	- Category (Security, Performance, Documentation, Clean Code, Framework)
59	- Severity (CRITICAL, MAJOR, MINOR, INFO)
60	- Rule ID (SonarQube rule when applicable, e.g., CA2050)
61	- Location (function/method name and approximate line)
62	- Finding (what is wrong)
63	- Fix (how to correct it, with code example when helpful)
64
65	### Step 4 — Produce the Report
66
67	Output findings as a structured report grouped by category, ordered by severity (CRITICAL first). End with a summary and overall assessment.
68
69	---
70
71	## Review Categories
72
73	### 1. Security (SonarQube G1)
74
75	Check for vulnerabilities that expose the application to attacks or data leaks. Key rules:
76
77	- CA2050 / CA2051 — SQL Injection: concatenating user input in SQL strings → use `FWExecStatement` (CRITICAL)
78	- CA2052 — Hardcoded credentials in source → use environment configuration (CRITICAL)
79	- BG1000 — `RpcSetEnv`/`RpcSetType` in REST/SOAP services → configure `PrepareIn` (MAJOR)
80	- *CA2022–CA2025, CA2053

People who liked this also viewed

6 picks

Type