Yocto recipe review

Skill Higangssh/yocto-agent-skills/skills/yocto-recipe-review

Review and improve Yocto/OpenEmbedded recipes, bbappends, bbclasses, package splits, dependencies, licensing, source fetching, patch handling, install logic, systemd/init integration, PACKAGECONFIG, and modern BitBake override syntax. Use for .bb, .bbappend, .bbclass, recipe diffs, recipe modernization, packaging errors, or metadata code review.From its SKILL.md

Install

npx -y skills add Higangssh/yocto-agent-skills --skill yocto-recipe-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.2 KB, as published. Nobody here has run it

Yocto Recipe Review

Use this skill for .bb, .bbappend, and .bbclass review. Optimize for release-aware, reproducible, package-correct metadata.

Review Checklist

Inspect:

SUMMARY
DESCRIPTION
HOMEPAGE
LICENSE
LIC_FILES_CHKSUM
SRC_URI
SRCREV
S
inherit
DEPENDS
PACKAGECONFIG
do_configure
do_compile
do_install
FILES:${PN}
RDEPENDS:${PN}
SYSTEMD_SERVICE:${PN}

Findings to Prioritize

old override syntax in a modern layer without a release reason
missing or vague LICENSE and LIC_FILES_CHKSUM
${AUTOREV} in production metadata
missing DEPENDS for headers, libraries, generated code tools, or -native tools
runtime dependency added to DEPENDS instead of RDEPENDS:<package>
installed files not covered by FILES:*
installing outside ${D}
host path or host tool contamination
unnecessary INSANE_SKIP
patch entries with missing upstream status or fuzz
bbappend that is too version-specific or too broad for the intended target

Modern Syntax

Prefer:

FILES:${PN} += "${bindir}/tool"
RDEPENDS:${PN} += "bash"
PACKAGECONFIG:append = " feature"
do_install:append() {
    install -d ${D}${bindir}
}

Avoid _append, _prepend, _remove, and old package override syntax unless the target release requires it.

References

Read references/variables-core.md for variable semantics.
Read references/classes-core.md for class-specific review.
Read references/qa-errors.md for package QA risks.
Use references/official-doc-map.md to route official docs.

Output

Lead with code-review findings:

Findings:
- [severity] file:line issue and Yocto impact

Suggested metadata:
...

Validation:
- bitbake -e <recipe>
- bitbake -c patch <recipe>
- bitbake <recipe>
- bitbake <image>

What ships with it: 4 files

24.5 KB alongside SKILL.md

references/

Gives 0 of the 12 instructions most review quality skills give

Counted across 1,273 of the 2,403 authors here whose files we hold, read 2026-09-06

Ask one question at a timein 63 of 1273, across 62 files
Provide a recommended answer for each questionin 47 of 1273, across 45 files
Rank findings by severityin 44 of 1273
Use parameterized queries for database accessin 38 of 1273, across 20 files
Validate all user input with schemasin 33 of 1273, across 15 files
Store secrets in environment variablesin 32 of 1273, across 14 files
Explore the codebase to answer questionsin 31 of 1273, across 29 files
Store tokens in httpOnly cookiesin 30 of 1273, across 12 files
Implement rate limiting on API endpointsin 30 of 1273, across 12 files
Sanitize user-provided HTMLin 29 of 1273, across 11 files
Return generic error messages to usersin 28 of 1273, across 10 files
Cite file and line for every findingin 28 of 1273, across 25 files

Said here and by no other author read

Inspect recipe variables and build functions
Prioritize modern override syntax over legacy syntax
Verify license files and checksums
Check dependencies for missing native tools
Ensure installed files are covered by package variables
Validate patch status and fuzz

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.