faces-review

Reviews Jakarta Faces code for anti-patterns, misconfigurations, and version-incompatible APIs.

25|1|Updated Mar 11, 2026
One-click install
npx skills add https://github.com/omnifaces/claude-faces-expert --skill faces-review-omnifaces
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: faces-review
Source: https://github.com/omnifaces/claude-faces-expert/tree/main/.claude/skills/faces-review
Command: npx skills add https://github.com/omnifaces/claude-faces-expert --skill faces-review-omnifaces

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Jakarta Faces (JSF) projects accumulate subtle mistakes — wrong scopes, broken ajax render targets, misplaced XHTML files, hand-rolled code duplicating built-ins — that cause hard-to-diagnose bugs like ViewExpiredException and uninvoked actions. This Skill audits your views, backing beans, and configuration against a curated rule set. ## Core Features & Use Cases - Version-aware review: Detects both the runtime and declared Faces versions first, then validates every recommendation against the APIs actually available in that version. - Structured checklist audit: Covers XHTML/Facelets rules, directory structure exposure risks, backing bean scope and CDI usage, web.xml/faces-config.xml descriptor versions, plus PrimeFaces and OmniFaces specifics. - Severity-ranked report: Groups findings by file with file/line, violated rule, severity (error/warning/info), and a concrete fix that never introduces new violations. - Use Case: Point it at a legacy JSF project before an upgrade to find superseded constructs (e.g., PhaseListener message shuttling replaceable by Flash.keepMessages) and security exposures like composite components outside WEB-INF. ## Quick Start Ask the assistant to run /faces-review on your project directory to audit all XHTML views and backing beans against Jakarta Faces best practices.

Frequently Asked Questions about faces-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Jakarta Faces code for common mistakes?

Run the faces-review skill on a file, directory, or whole project. It scans XHTML views and backing beans against a rules checklist covering namespaces, forms, ajax targets, scopes, and configuration, then reports findings grouped by file with severity and fixes.

How to check if my JSF code uses APIs compatible with my Faces version?

The skill first detects your runtime Faces version from dependencies like jakarta.faces-api, Mojarra, or MyFaces, then verifies every recommended API exists in that version. Newer APIs are only mentioned as info-level suggestions labeled with the required upgrade version.

Does the Faces review support PrimeFaces and OmniFaces?

Yes. When PrimeFaces or OmniFaces dependencies are detected, the skill applies additional rule sets from dedicated topic files, including PrimeFaces process/update gotchas and OmniFaces converter and validator managed-attribute pitfalls.

Why are XHTML files outside WEB-INF flagged as a security issue?

Templates, includes, tag files, and composites in the webapp root are directly reachable. With legacy FacesServlet mappings like *.jsf, the raw Facelets source becomes downloadable, exposing EL expressions and bean names; the skill recommends moving them under WEB-INF.

What severity levels does the Faces code review report use?

Findings are classified as error (will cause bugs), warning (anti-pattern or risk), or info (improvement opportunity). Each finding includes file and line, the violated rule, and a concrete fix validated so it does not introduce new violations.