360 Secure SkillHub
360 安全技能中心

Composer Json Validator

该 Skill 通过本地 Python 脚本校验和 lint PHP 项目的 composer.json，检查 JSON 语法、必需字段、包名格式、依赖版本约束、PSR-4 自动加载、最低稳定性与仓库地址等 22 项规则，并支持 text、json、markdown 输出及 --strict CI 模式。脚本仅读取本地文件，不安装依赖，也不访问网络。

charlie-morrison
charlie-morrison
热度 48.92
最近更新 2026-05-11 17:42:55
分类：开发依赖：代码执行 / 读写文件应用场景：代码审查 / DevOps

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add composer-json-validator
Metadata
name
composer-json-validator
description
Validate and lint PHP Composer composer.json files for structure, dependencies, autoload, and best practices. Use when asked to lint, validate, check, or audit composer.json files, verify PHP project configuration, or ensure Composer quality. Triggers on "lint composer", "validate composer.json", "check php deps", "composer best practices".

Composer JSON Validator

Validate and lint PHP Composer composer.json files for structure, dependencies, autoload configuration, and best practices.

Commands

lint — Run all lint checks

python3 scripts/composer_json_validator.py lint composer.json
python3 scripts/composer_json_validator.py lint composer.json --strict
python3 scripts/composer_json_validator.py lint composer.json --format json
python3 scripts/composer_json_validator.py lint composer.json --format markdown

dependencies — Inspect require/require-dev

python3 scripts/composer_json_validator.py dependencies composer.json
python3 scripts/composer_json_validator.py dependencies composer.json --format json

scripts — Inspect scripts section

python3 scripts/composer_json_validator.py scripts composer.json
python3 scripts/composer_json_validator.py scripts composer.json --format markdown

validate — Full validation (structure + lint + summary)

python3 scripts/composer_json_validator.py validate composer.json
python3 scripts/composer_json_validator.py validate composer.json --strict --format json

Flags

Flag Description
--strict Exit code 1 on warnings (CI-friendly)
--format text Human-readable output (default)
--format json Machine-readable JSON
--format markdown Markdown report

Lint Rules (22 checks)

Structure (5)

  1. Valid JSON syntax
  2. Required fields: name, description, type
  3. Valid package name format (vendor/package)
  4. Valid type value (library, project, metapackage, composer-plugin)
  5. license field present and valid SPDX identifier

Dependencies (6)

  1. No duplicate packages across require and require-dev
  2. Version constraints use valid operators (^, ~, >=, etc.)
  3. No dev-only packages in require (phpunit, mockery, etc.)
  4. No wildcard * versions
  5. PHP version constraint present in require
  6. ext-* dependencies are explicit (not *)

Autoload (4)

  1. PSR-4 autoload defined
  2. Namespace ends with \\ (PSR-4 convention)
  3. No duplicate namespaces across autoload entries
  4. autoload-dev separate from autoload

Best Practices (7)

  1. scripts section present
  2. No post-install-cmd/post-update-cmd executing arbitrary URLs
  3. config.sort-packages enabled
  4. minimum-stability explicit when not stable
  5. prefer-stable set when minimum-stability is not stable
  6. No hardcoded absolute paths in autoload
  7. All repository URLs use HTTPS

Exit Codes

Code Meaning
0 No errors (warnings allowed unless --strict)
1 Errors found (or warnings in --strict mode)
2 Invalid arguments / file not found

Example Output

composer.json lint results
==========================
[ERROR]   name: Package name must match vendor/package format
[WARN]    dependencies: phpunit/phpunit found in require (should be in require-dev)
[WARN]    autoload: config.sort-packages not enabled
[INFO]    scripts: scripts section present

Summary: 1 error(s), 2 warning(s), 1 info