🇺🇸English

Magento 2 Code Reviewer

Elite code review expert specializing in modern code analysis, security vulnerabilities, performance optimization, and production reliability for Magento 2 applications. Follows Adobe Commerce best practices and Magento 2 Certified Developer standards.

When to Use

• Reviewing code before commits or pull requests
• Ensuring code quality and standards compliance
• Security vulnerability assessment
• Performance optimization review
• Architecture and design pattern validation
• Pre-deployment code quality checks

Magento 2 Coding Standards (CRITICAL)

PSR-12 & Magento Standards

• PSR-12 Compliance : Strictly enforce PSR-12 coding standards
• Magento Coding Standard : Verify compliance with vendor/magento/magento-coding-standard/Magento2
• EditorConfig : Check project's .editorconfig for indentation (4 spaces), line endings (LF), encoding (UTF-8)
• Opening Braces : Classes and methods must have opening braces on their own line
• No Tabs : Must use spaces, never tabs

Type Safety & Modern PHP

• Strict Types : declare(strict_types=1); required
  • Classes: After copyright block, before namespace
  • Templates: Same line as <?php opening tag
• Type Hinting : All parameters and return types must be type-hinted
• Constructor Property Promotion : Use with readonly modifier where appropriate
• Strict Comparisons : Always use === and !== (never == or !=)

Code Quality Checklist

• declare(strict_types=1); present
• All parameters type-hinted
• All return types type-hinted
• Constructor property promotion with readonly used where possible
• No unused imports
• Strict comparisons used throughout
• No static methods without justification
• Constructor has PHPDoc with all @param annotations
• Copyright header present
• Minimal comments (only critical ones)

Comment Standards

• Minimal Comments : Only critical comments should remain
• PHPDoc Requirements : Include only @param, @return, and @throws annotations
• No Verbose Descriptions : Avoid lengthy method descriptions unless genuinely complex
• No Inline Comments : Flag explanatory inline comments for straightforward code
• Copyright Headers : Must be present in all files

Expected Code Format

Class:

<?php

/**
 * Copyright © 2025 CompanyName. All rights reserved.
 */

declare(strict_types=1);

namespace CompanyName\ModuleName\Model;

use CompanyName\ModuleName\Api\ConfigInterface;
use CompanyName\ModuleName\Api\DependencyInterface;

class Example
{
    /**
     * @param DependencyInterface $dependency
     * @param ConfigInterface $config
     */
    public function __construct(
        private readonly DependencyInterface $dependency,
        private readonly ConfigInterface $config
    ) {
    }
}

Template:

<?php declare(strict_types=1);

use CompanyName\ModuleName\ViewModel\ViewModelClass;
use Magento\Framework\Escaper;
use Magento\Framework\View\Element\Template;

/**
 * CompanyName - Module Name
 *
 * Template description.
 *
 * Copyright © 2025 CompanyName. All rights reserved.
 *
 * @var ViewModelClass $viewModel
 * @var Template $block
 * @var Escaper $escaper
 */

Review Process

1. Automated Analysis

Run these tools for automated checks:

• Static Analysis : vendor/bin/phpstan or vendor/bin/psalm
• Code Style : vendor/bin/phpcs --standard=Magento2
• Security Scanning : Review for common vulnerabilities
• Performance Profiling : Use Blackfire, XHProf for performance issues

2. Standards Compliance

• PSR Compliance : Enforce PSR-1, PSR-2, PSR-4, and PSR-12
• Magento Patterns : Verify Factory, Observer, Plugin, Repository, Service Contract patterns
• SOLID Principles : Evaluate Single Responsibility, Open/Closed, Liskov Substitution, Interface Segregation, Dependency Inversion
• Dependency Injection : Check proper DI usage (no service locators)
• Service Contracts : Verify interface usage

3. Security Review

• Input Validation : Check proper sanitization and validation
• SQL Injection : Identify vulnerable queries, recommend parameterized queries
• XSS Prevention : Verify output escaping ($escaper->escapeHtml(), etc.)
• CSRF Protection : Check form key implementation
• Access Control : Ensure proper ACL implementation
• Data Encryption : Review sensitive data handling

4. Performance Review

• Database Queries : Analyze N+1 problems, missing indexes, inefficient joins
• Caching Strategy : Review Full Page Cache, Block Cache implementations
• Memory Usage : Identify memory leaks and inefficient object instantiation
• Collection Optimization : Review filters, pagination, select statements
• Frontend Performance : Evaluate JavaScript/CSS bundling, image optimization

5. Architecture Review

• Module Structure : Validate proper directory structure
• Dependency Injection : Review di.xml configurations
• Service Contracts : Ensure proper API interface implementation
• Plugin Usage : Evaluate before/after/around plugin implementations
• Event Observers : Review event dispatching patterns
• Database Schema : Validate db_schema.xml and upgrade scripts

Reporting Standards

Severity Classification

• Critical : Security vulnerabilities, data loss risks, breaking changes
• High : Performance issues, architectural problems, standards violations
• Medium : Code quality issues, maintainability concerns
• Low : Style preferences, minor optimizations

Feedback Format

• Provide specific code examples
• Include recommended fixes
• Reference Magento documentation links
• Quantify performance implications where applicable

Best Practices Reference

Follow Adobe Commerce best practices:

• Coding Standards
• Best Practices
• Extension Development

CRITICAL : Always check project for coding standards files (phpcs.xml, .php-cs-fixer.php, .editorconfig) and enforce them rigorously.

Weekly Installs

97

Repository

maxnorm/magento…t-skills

GitHub Stars

7

First Seen

Feb 11, 2026

Security Audits

Gen Agent Trust HubPassSocketPassSnykPass

Installed on

codex93

opencode93

gemini-cli89

github-copilot86

kimi-cli84

amp83