skills.rest
totvs
totvsOFFICIAL
Explore all skills by this author →
Website𝕏@TOTVSDevelopersGitHub

code-review

Review AdvPL/TLPP sources for security, performance, and Protheus compliance.

115|54|Updated May 25, 2026
Search Tags:#static analysis#code review#security#sonarqube#advpl#tlpp#protheusdoc
One-click install
npx skills add https://github.com/totvs/engpro-advpl-tlpp-skills --skill code-review-totvs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review
Source: https://github.com/totvs/engpro-advpl-tlpp-skills/tree/main/skills/advpl-tlpp/code-review
Command: npx skills add https://github.com/totvs/engpro-advpl-tlpp-skills --skill code-review-totvs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents fragile, insecure, and non-compliant AdvPL/TLPP code from reaching production by guiding you through a structured review aligned with SonarQube, ProtheusDOC, and framework best practices.

Core Features & Use Cases

  • Security-focused findings: Detects SQL injection patterns, hardcoded credentials, restricted/prohibited usages, and other vulnerabilities with severity and fix guidance.
  • Quality, performance, and clean-code checks: Flags inefficient patterns, prohibited APIs inside loops/transactions, deprecated/legacy constructs, and naming/scope issues.
  • ProtheusDOC and TLPP compliance: Ensures documentation blocks and (when applicable) TLPP-specific rules like type annotations and proper error handling.

Quick Start

Ask the agent to review the provided AdvPL/TLPP file and return a categorized report with critical/major/minor findings and suggested fixes.

Frequently Asked Questions about code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review AdvPL code for security vulnerabilities and SonarQube compliance?▼

To review AdvPL code for security and SonarQube compliance, request an audit of your .prw, .tlpp, or .prx sources to receive a structured report with severity, rule identifiers, locations, and fix suggestions.

Can I check TLPP sources for ProtheusDOC validation and clean code standards?▼

Yes, you can check TLPP sources for ProtheusDOC validation and clean code standards by auditing .tlpp files to verify documentation blocks, type annotations, error handling, and naming scope.

What is the best way to audit Protheus legacy code for deprecated constructs?▼

The best way to audit Protheus legacy code for deprecated constructs is performing a comprehensive review that flags legacy patterns, prohibited APIs inside loops or transactions, and maps findings to SonarQube-aligned rules.

Does the code review support pre-commit quality gates for .prw and .prx files?▼

Yes, the code review supports pre-commit quality gates for .prw and .prx files by analyzing sources for security vulnerabilities, performance issues, and Protheus framework compliance before code reaches production.

How do I identify SQL injection patterns in AdvPL pull requests?▼

To identify SQL injection patterns in AdvPL pull requests, run a security-focused code review that detects injection vulnerabilities and restricted usages, returning a categorized report with critical, major, and minor findings.

Related Skills

Explore More Software Engineering Skills→
totvstotvs
115

advpl-to-tlpp-migration

Migrate legacy AdvPL .prw/.prx sources to modern TLPP .tlpp code.

Official
Advanced
totvstotvs
115

documentation-writer

Generate ProtheusDOC comment blocks for AdvPL and TLPP source code elements.

Official
Intermediate
sandgardenhqsandgardenhq
130

go-code-review

Review Go code against official style guides and static analysis guidelines.

Official
Basic
ToanPV90ToanPV90

sast-scanning

Detects source code vulnerabilities via static analysis with JSON/SARIF outputs.

Community
Advanced