Mind-Vision-Code/.ai/skills/workflow/SKILL.md

Agent Workflow Skill

Purpose

Use this skill for AI agent behavior, multi-file work, pull-request checks, legacy PHP changes, non-negotiable rules, response format, and skill feedback.

---

Agent Workflow

When modifying this codebase, the AI agent must:

1. Inspect existing project conventions before adding new patterns.
2. Prefer small, focused changes.
3. Preserve public behavior unless explicitly asked to change it.
4. Add or update tests when behavior changes.
5. Run relevant checks when possible.
6. Explain any checks that could not be run.
7. Avoid introducing new dependencies unless they solve a clear problem.
8. Never place secrets in code, tests, fixtures, logs, or documentation.
9. Keep generated code consistent with this file and the loaded skill files.
10. Leave the repository better organized than it was found.

---

Pull Request / Review Checklist

Before considering work complete:

• Code follows PSR-12 or project-specific style.
• Namespaces and autoloading are correct.
• Composer files are valid.
• No unrelated dependency updates were introduced.
• New behavior is tested.
• Existing tests pass.
• SQL is parameterized.
• User input is validated.
• Output is escaped.
• No secrets are committed.
• Errors are handled safely.
• Documentation was updated where needed.

---

Legacy PHP Exception Policy

If this project contains legacy PHP:

• Do not rewrite large areas without approval.
• Add tests around legacy behavior before refactoring.
• Improve safety incrementally.
• Replace deprecated patterns as touched.
• Avoid mixing modernization with unrelated feature work.
• Document any compatibility constraints.

Legacy code should still move toward:

• Composer autoloading
• Namespaces
• PDO/prepared statements
• Centralized configuration
• Automated tests
• Safer error handling

---

Non-Negotiable Rules

The agent must not:

• Commit secrets.
• Build SQL using untrusted string concatenation.
• Store plain-text passwords.
• Use md5, sha1, or raw fast hashes for passwords.
• Display production errors to users.
• unserialize() untrusted data.
• Put database queries in templates.
• Edit files under vendor/.
• Add dependencies without a clear reason.
• Ignore failing tests or quality checks without explanation.

---

Response Format

For non-trivial tasks, respond using this structure:

Goal:
Route:
Assumptions:
Plan:
Implementation:
Tests:
Risks:

For simple questions, answer directly.

---

Skill Feedback Rule

If project guidance is missing or unclear, suggest an update.

Suggested SKILLS.md update:
- Add/update: ...
- Reason: ...

---

Final Instruction to Coding Agents

When in doubt, choose the boring, obvious, secure PHP solution:

• Composer-managed dependencies
• PSR-style code
• Namespaced classes
• Dependency injection
• PDO prepared statements
• Escaped output
• Tested behavior
• Clear errors and logs
• No secrets in source control