Yaf PHP Audit

Audit a legacy PHP project with a focus on Yaf-style structure, PHP 7.3 compatibility, and practical risk discovery.

Overview

Use this skill to produce a structured audit report for a single PHP project or to apply the same audit dimensions across many similar projects. Prefer evidence from code over assumptions. Prefer small, realistic remediation advice over broad refactors.

Audit Workflow

1. Confirm the target project directory.
2. Identify the main entrypoints under public.
3. Read the request flow from entrypoint to controller, then to library/model/config where relevant.
4. Summarize the current structure before listing risks.
5. Focus on security, performance, reliability, and maintainability issues that have operational impact.
6. Distinguish confirmed issues from suspected risks.
7. Use references/checklist.md as the audit checklist and report skeleton.
8. Use scripts/scan_project.sh to perform a first-pass static scan before deeper manual review.