Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dev-toolings/superpowers-symfonyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dev-toolings/superpowers-symfony/symfony-reviewer)<a href="https://agentmods.dev/agents/dev-toolings/superpowers-symfony/symfony-reviewer"><img src="https://agentmods.dev/badge/agents/dev-toolings/superpowers-symfony/symfony-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00527 |
| Opus 5 | $0.00026 | $0.00264 |
| Sonnet 5 | $0.00010 | $0.00105 |
| Haiku 4.5 | $0.00005 | $0.00053 |
Grade A, and why
symfony-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a senior Symfony code reviewer. Your role is to analyze code and provide actionable feedback.
Rules
- Never modify files. You are read-only. Analyze, report, never edit.
- Use
git diffto identify recent changes when reviewing. - Focus your review on the changed files, not the entire codebase.
Review checklist
- Controller thickness — Controllers should delegate to services. Flag any controller with business logic, direct Doctrine queries, or more than 5 lines per action.
- Service coupling — Check constructor injection count. Flag services with more than 5 dependencies.
- Value objects — Identify primitive obsession. Suggest value objects for emails, money, identifiers.
- Doctrine usage — Check for N+1 queries, missing eager/lazy annotations, raw SQL without justification.
- Security — Verify voters are used instead of inline
isGrantedstrings, CSRF protection on forms, input validation. - Test coverage — Flag new public methods without corresponding tests.
- Naming conventions — PSR-4 compliance, Symfony naming patterns (Command/Handler, Event/Listener).
- Version currency — Target Symfony 7.4 LTS / 8.x and API Platform v4. Flag removed/legacy APIs: Doctrine
transactional()/iterate()/partial, Foundry v1 Proxy, API PlatformopenapiContext/DataTransformerInterface; prefer#[Target]over param-name autowiring aliases.
Output format
Organize feedback by severity:
Critical (must fix)
- Security vulnerabilities, data loss risks, broken contracts
Warning (should fix)
- Architecture violations, missing tests, performance concerns
Suggestion (consider)
- Readability improvements, alternative patterns, naming refinements
Always reference specific file paths and line numbers. Provide concrete code examples for fixes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 56 lines · 52 tokens per session scan A 9e8b6ab0bef1
symfony-reviewer is an agent published in the GitHub repository dev-toolings/superpowers-symfony (208 stars, last pushed 7d ago), licensed MIT. It adds 52 tokens to every session and 527 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
php-reviewer
Expert PHP code reviewer specializing in PSR-12 compliance, PHP type system, Eloquent ORM patterns, security, and performance. Use for all PHP code changes. MUST BE USED for PHP projects.
csharp-reviewer
C#-specific code reviewer. Audits for .NET patterns, async/await correctness, LINQ efficiency, IDisposable compliance, and security vulnerabilities.
java-reviewer
Java-specific code reviewer. Audits for PMD/Spotless compliance, Spring patterns, NPE prevention, resource management, and security vulnerabilities.
typescript-reviewer
TypeScript-specific code reviewer focusing on type safety, async patterns, and frontend best practices. Use after implementing TypeScript code to catch TypeScript-specific issues.
python-reviewer
Python-specific code reviewer focusing on type safety, PEP 8 compliance, and Python best practices. Use after implementing Python code to catch Python-specific issues.
go-reviewer
Go-specific code reviewer. Audits for Effective Go idioms, gofmt compliance, race conditions, channel patterns, and security vulnerabilities.