Composer JSON Validator

Validate and lint PHP Composer composer.json files for structure, dependencies, autoload, and best practices. Use when asked to lint, validate, check, or aud...

Security Scan

The skill's stated purpose (linting composer.json) matches the provided manifest and runtime instructions, but the included Python script was only partially shown (truncated), so I cannot fully verify there is no unexpected behavior; proceed with caution and review the full script before use.

Purpose & Capability

Name, description, SKILL.md usage examples, and the included script all align: the skill is a composer.json linter and the runtime instructions call the bundled Python script against a composer.json file. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md only instructs running the bundled script (python3 scripts/composer_json_validator.py) with the target composer.json and flags for format/strictness. It does not ask the agent to read arbitrary system files, environment variables, or post data to external endpoints in the instructions.

Install Mechanism

There is no install spec (instruction-only invocation of a bundled script). Nothing will be downloaded or written to disk beyond the existing packaged files. This is low-risk relative to remote-install behaviors.

Credentials

The skill declares no required environment variables or credentials, which is proportionate. The bundled script appears to read only the composer.json file passed on the command line. However, the Python source was truncated in the provided bundle listing, so it is not possible to confirm it does not access environment variables, other files, or network resources.

Persistence & Privilege

The skill does not request always: true and has no install-time actions declared that would persist or modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) — note this is normal but means the skill could be run without direct user prompting if the agent chooses to.

Scan Findings in Context

[no_regex_findings] expected: The pre-scan reported no regex-based injection signals. That matches expectations for a static linter script, but absence of findings is not proof of safety—the provided python source was truncated and could contain unanalyzed code.

What to consider before installing

This skill appears internally consistent: its description, SKILL.md, and the included Python script (so far) match a composer.json linter. Before installing or running it, open and review the entire scripts/composer_json_validator.py file yourself (or have someone you trust do so) to confirm it does not: (1) call out to the network (requests/curl/wget/subprocess), (2) execute arbitrary shell commands, (3) read unrelated files or environment variables, or (4) write files outside a safe working directory. If you cannot review the full script, run it in an isolated sandbox/container with only the composer.json you want to lint. Also note the skill listing mentions a $49 price in STATUS.md — verify licensing and payment expectations before publishing or paying.

Validate and lint PHP Composer composer.json files for structure, dependencies, autoload configuration, and best practices.

Commands

lint — Run all lint checks

python3 scripts/composer_json_validator.py lint composer.json
python3 scripts/composer_json_validator.py lint composer.json --strict
python3 scripts/composer_json_validator.py lint composer.json --format json
python3 scripts/composer_json_validator.py lint composer.json --format markdown

dependencies — Inspect require/require-dev

python3 scripts/composer_json_validator.py dependencies composer.json
python3 scripts/composer_json_validator.py dependencies composer.json --format json

scripts — Inspect scripts section

python3 scripts/composer_json_validator.py scripts composer.json
python3 scripts/composer_json_validator.py scripts composer.json --format markdown

validate — Full validation (structure + lint + summary)

python3 scripts/composer_json_validator.py validate composer.json
python3 scripts/composer_json_validator.py validate composer.json --strict --format json

Flags

Flag	Description
--strict	Exit code 1 on warnings (CI-friendly)
--format text	Human-readable output (default)
--format json	Machine-readable JSON
--format markdown	Markdown report

Lint Rules (22 checks)

Structure (5)

1. Valid JSON syntax
2. Required fields: name, description, type
3. Valid package name format (vendor/package)
4. Valid type value (library, project, metapackage, composer-plugin)
5. license field present and valid SPDX identifier

Dependencies (6)

6. No duplicate packages across require and require-dev
7. Version constraints use valid operators (^, ~, >=, etc.)
8. No dev-only packages in require (phpunit, mockery, etc.)
9. No wildcard * versions
10. PHP version constraint present in require
11. ext-* dependencies are explicit (not *)

Autoload (4)

12. PSR-4 autoload defined
13. Namespace ends with \\ (PSR-4 convention)
14. No duplicate namespaces across autoload entries
15. autoload-dev separate from autoload

Best Practices (7)

16. scripts section present
17. No post-install-cmd/post-update-cmd executing arbitrary URLs
18. config.sort-packages enabled
19. minimum-stability explicit when not stable
20. prefer-stable set when minimum-stability is not stable
21. No hardcoded absolute paths in autoload
22. All repository URLs use HTTPS

Exit Codes

Code	Meaning
0	No errors (warnings allowed unless --strict)
1	Errors found (or warnings in --strict mode)
2	Invalid arguments / file not found

Example Output

composer.json lint results
==========================
[ERROR]   name: Package name must match vendor/package format
[WARN]    dependencies: phpunit/phpunit found in require (should be in require-dev)
[WARN]    autoload: config.sort-packages not enabled
[INFO]    scripts: scripts section present

Summary: 1 error(s), 2 warning(s), 1 info