joomla

Plugin joomla from marketplace joomla-bible-study in Joomla-Bible-Study/joomla-skills. Commands read from the repo's manifest — 1 month ago.

Skills (17)

• audit-authz

  Audit Joomla component controllers for missing anti-CSRF token checks, missing authentication, and missing authorisation. Use when reviewing controller access control on a Joomla extension, or when explicitly invoked for an authorisation security audit. For checks that exist but target the wrong per

• audit-code-execution

  Audit Joomla extensions for attacker-influenced data reaching server-side code, command, or object execution sinks — shell commands, eval and dynamic include, unsafe deserialisation, PHAR, and attacker-selected callables or class names. Use when reviewing RCE exposure in a Joomla extension, or when

• audit-controller-exposure

  Audit Joomla controllers for privilege checks that target the wrong permission or asset, backend-only tasks reachable from the site or api application, and unsafe file uploads. Use when reviewing controller privilege scope or upload handling on a Joomla extension, or when explicitly invoked for this

• audit-file-operations

  Audit attacker-influenced filesystem paths and archive entries in Joomla extensions for traversal, Zip Slip, symlink escape, and arbitrary read/write/delete. Use when reviewing file reads, downloads, writes, deletes, includes, or archive extraction in a Joomla extension, or when explicitly invoked f

• audit-jexec

  Audit Joomla extension PHP files for the missing `_JEXEC` direct-access guard, then add it. Use when checking distributed Joomla extension files for direct web access protection, or when explicitly invoked for a `_JEXEC` check.

• audit-object-access

  Audit Joomla record access paths for IDOR, BOLA, ownership bypass, and cross-user data leakage — whether every attacker-selectable identifier is constrained to what the current user may see or change. Use when reviewing per-record data isolation in a Joomla extension, or when explicitly invoked for

• audit-package-surface

  Audit what a Joomla extension's build actually distributes and installs — unintended shipped files, directly reachable executable entry points, unsafe installer and update behaviour, and vulnerable production dependencies. Use when reviewing release packaging or install/update surface for a Joomla e

• audit-secrets-crypto

  Audit Joomla extensions for exposed secrets, weak or predictable security tokens, unsafe password handling, and cryptographic designs that do not provide their claimed property. Use when reviewing credentials, key material, token generation and comparison, or encryption in a Joomla extension, or whe

• audit-sensitive-output

  Audit Joomla extension responses, logs, exports, errors, mail, and caches for injection into a downstream interpreter or disclosure of sensitive data. Covers response headers, CSV formula injection, log forging, error disclosure, mail header injection, and cache isolation. Use when reviewing non-HTM

• audit-sql-filtering

  Audit Joomla filter, user-state, and user-input values that reach SQL queries for unsafe validation, escaping, or parameterisation. Use for SQL injection reviews of a Joomla extension, or when explicitly invoked for SQL filtering analysis. For missing authentication/authorisation/CSRF checks see aud

• audit-ssrf-redirects

  Audit Joomla extension URL flows for server-side request forgery and unsafe redirects — attacker-influenced URLs reaching an HTTP client or a browser Location header, including cloud-metadata and internal-service reachability and open redirects. Use when reviewing outbound requests or redirect targe

• audit-xss

  Audit Joomla extension output paths for reflected, stored, and DOM-based cross-site scripting. Use when reviewing browser output escaping, rich HTML filtering, or client-side DOM insertion in a Joomla extension, or when explicitly invoked for an XSS audit. For non-HTML headers, exports, logs, mail,

• e2e-tests

  Set up or extend end-to-end integration tests that drive a real, disposable Joomla or standalone PHP stack in Docker over real HTTP, with a version matrix derived from what the project actually declares. Use when adding E2E or browser-level integration tests, testing template and HTTP behaviour that

• joomla-deprecations

  Find and fix uses of deprecated or removed Joomla core APIs in an extension, sourced from the official Joomla Manual's per-version deprecation lists, while preserving the extension's whole supported Joomla range. Use when preparing an extension for a newer Joomla version, when a deprecation notice a

• joomla

  Joomla 5+ / 6 / 7 extension development for components, modules, plugins, libraries, and templates using modern MVC with PSR-4, DI, and service providers. Trigger on Joomla 5, 5.4, 6, 6.1, 6.2, 7, J5/J6/J7, Joomla CMS, provider.php, manifest XML, install script, scriptfile, cli/joomla.php, or any Jo

• php-conservative

  Check a Joomla extension or any PHP project for compatibility with every stable PHP version it claims to support, using PHP_CodeSniffer with the PHPCompatibility standard over a testVersion range derived from composer.json. Knows that Joomla's bundled Symfony polyfills make some findings false posit

• php-upcoming

  Check a Joomla extension or PHP project against the next, not-yet-released PHP version by executing its test suite on that PHP with full error reporting — the only method that works, since static analysis has no sniff data for an unreleased version. Use when preparing for an upcoming PHP release or

Similar plugins