Claude Skills by Joomla-Bible-Study

Joomla 5+ / 6 / 7 extension development for components, modules, plugins, libraries, and templates using modern MVC with PSR-4, DI, and service providers. Trigger on Joomla 5, 5.4, 6, 6.1, 6.2, 7, J5/J6/J7, Joomla CMS, provider.php, manifest XML, install script, scriptfile, or any Joomla extension code. Covers scaffolding; MVC views/models/controllers; service providers; manifests; database migrations; language files; form fields; layout and template overrides; plugin event subscribers (Subsc...

Audit Joomla component controllers for missing anti-CSRF token checks, missing authentication, and missing authorisation. Use when reviewing controller access control on a Joomla extension, or when explicitly invoked for an authorisation security audit. For checks that exist but target the wrong permission, backend-only tasks reachable from the frontend, or unsafe uploads, use audit-controller-exposure instead.

Audit Joomla extensions for attacker-influenced data reaching server-side code, command, or object execution sinks — shell commands, eval and dynamic include, unsafe deserialisation, PHAR, and attacker-selected callables or class names. Use when reviewing RCE exposure in a Joomla extension, or when explicitly invoked for a code execution audit. Browser-side script execution belongs to audit-xss.

Audit Joomla controllers for privilege checks that target the wrong permission or asset, backend-only tasks reachable from the site or api application, and unsafe file uploads. Use when reviewing controller privilege scope or upload handling on a Joomla extension, or when explicitly invoked for this audit. Cross-references audit-authz for missing auth/CSRF checks and audit-sql-filtering for SQL injection.

Audit attacker-influenced filesystem paths and archive entries in Joomla extensions for traversal, Zip Slip, symlink escape, and arbitrary read/write/delete. Use when reviewing file reads, downloads, writes, deletes, includes, or archive extraction in a Joomla extension, or when explicitly invoked for a filesystem audit. File type acceptance and initial upload storage belong to audit-controller-exposure.

Audit Joomla extension PHP files for the missing `_JEXEC` direct-access guard, then add it. Use when checking distributed Joomla extension files for direct web access protection, or when explicitly invoked for a `_JEXEC` check.

Audit Joomla record access paths for IDOR, BOLA, ownership bypass, and cross-user data leakage — whether every attacker-selectable identifier is constrained to what the current user may see or change. Use when reviewing per-record data isolation in a Joomla extension, or when explicitly invoked for an object-level access audit. For whether an entry point has any check see audit-authz; for whether it checks the right permission see audit-controller-exposure.

Audit what a Joomla extension's build actually distributes and installs — unintended shipped files, directly reachable executable entry points, unsafe installer and update behaviour, and vulnerable production dependencies. Use when reviewing release packaging or install/update surface for a Joomla extension, or when explicitly invoked for a package surface audit. Missing _JEXEC guards in intended files belong to audit-jexec.

Audit Joomla extensions for exposed secrets, weak or predictable security tokens, unsafe password handling, and cryptographic designs that do not provide their claimed property. Use when reviewing credentials, key material, token generation and comparison, or encryption in a Joomla extension, or when explicitly invoked for a secrets and cryptography audit.

Audit Joomla extension responses, logs, exports, errors, mail, and caches for injection into a downstream interpreter or disclosure of sensitive data. Covers response headers, CSV formula injection, log forging, error disclosure, mail header injection, and cache isolation. Use when reviewing non-HTML output sinks in a Joomla extension, or when explicitly invoked for this audit. Browser script execution belongs to audit-xss.

Audit Joomla filter, user-state, and user-input values that reach SQL queries for unsafe validation, escaping, or parameterisation. Use for SQL injection reviews of a Joomla extension, or when explicitly invoked for SQL filtering analysis. For missing authentication/authorisation/CSRF checks see audit-authz; for privilege mismatches, backend-task leakage, or unsafe uploads see audit-controller-exposure.

Audit Joomla extension URL flows for server-side request forgery and unsafe redirects — attacker-influenced URLs reaching an HTTP client or a browser Location header, including cloud-metadata and internal-service reachability and open redirects. Use when reviewing outbound requests or redirect targets in a Joomla extension, or when explicitly invoked for an SSRF audit.

Audit Joomla extension output paths for reflected, stored, and DOM-based cross-site scripting. Use when reviewing browser output escaping, rich HTML filtering, or client-side DOM insertion in a Joomla extension, or when explicitly invoked for an XSS audit. For non-HTML headers, exports, logs, mail, and caches see audit-sensitive-output; for server-side execution see audit-code-execution; for SQL injection see audit-sql-filtering.

Set up or extend end-to-end integration tests that drive a real, disposable Joomla or standalone PHP stack in Docker over real HTTP, with a version matrix derived from what the project actually declares. Use when adding E2E or browser-level integration tests, testing template and HTTP behaviour that in-process tests cannot observe, or building a disposable Docker test stack for an extension. Unit and in-process integration tests belong to the joomla skill's testing reference.

Find and fix uses of deprecated or removed Joomla core APIs in an extension, sourced from the official Joomla Manual's per-version deprecation lists, while preserving the extension's whole supported Joomla range. Use when preparing an extension for a newer Joomla version, when a deprecation notice appears, or when explicitly invoked for a deprecations pass.

Check a Joomla extension or any PHP project for compatibility with every stable PHP version it claims to support, using PHP_CodeSniffer with the PHPCompatibility standard over a testVersion range derived from composer.json. Knows that Joomla's bundled Symfony polyfills make some findings false positives in extensions but real in standalone projects. Use when auditing PHP version compatibility, chasing deprecation notices, or deciding whether a supported PHP range is actually safe — and when e...

Check a Joomla extension or PHP project against the next, not-yet-released PHP version by executing its test suite on that PHP with full error reporting — the only method that works, since static analysis has no sniff data for an unreleased version. Use when preparing for an upcoming PHP release or chasing deprecations that PHPCompatibility cannot see. For released PHP versions use php-conservative instead.