Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ddtcorex/maestro-skills --skill govard-magentogit clone --depth 1 https://github.com/ddtcorex/maestro-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ddtcorex/maestro-skills/govard-magento)<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/govard-magento"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/govard-magento/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/govard-magento"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/govard-magento.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.04247 |
| Opus 5.5 | $0.00046 | $0.01699 |
| Sonnet 5.5 | $0.00023 | $0.00849 |
| Haiku 4.5 | $0.00012 | $0.00425 |
Grade A, and why
govard-magento scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Govard Magento Commands
Magento-specific shortcuts and commands for Govard environments. Run govard <cmd> --help for the current flag set and govard capabilities for what the installed binary supports.
Related Skills
REQUIRED BACKGROUND: Load govard-toolbox first. This skill only covers Magento-specific shortcuts layered on top of Govard's base environment commands.
Stack commands need Docker running. govard audit run --checks integrity is the container-free exception (see govard-toolbox, "Host Without Docker").
This skill covers only container/CLI shortcuts. For module architecture, DI, and security patterns, see magento2-dev-core and magento2-backend-dev; for code quality and performance checks, see magento2-linter, magento2-security-scan, and magento2-performance-audit.
Code Quality Audit
govard audit run --checks lint is the native, persistent lint gate for this project. Target-mode resolution, the PHP matrix, provider rules, and caching/rerun identity are covered in magento2-linter ("Govard-Native Lint Audit Is the Real Gate"); this skill does not duplicate that policy. To re-check the exact same session (for example after a fix) instead of starting a fresh, non-comparable run:
govard audit rerun --session SESSION_ID
Optionally capture a page-profile artifact in the same run:
govard audit run --checks lint,profiler --url 'https://<domain>/'
The profiler reads the CSV Magento writes to var/log/profiler.csv. If the run fails with "collect Magento profiler CSV ... No such file", Magento never wrote the file for that request, so the capture is unusable; try another uncached HTML URL. Policy details live in magento2-linter.
Gotchas:
- An audit refuses to run while Xdebug is enabled, to protect timing fidelity. Pass
--allow-xdebugto accept the overhead, or turn Xdebug off withgovard debug off. (The error text suggestsgovard config set stack.features.xdebug false, butconfig setrejects that key.) audit rerunreuses the session's stored checks. Passing a different--checksset than the session recorded can fail with "no persisted ... settings"; start a newaudit runinstead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed d372f4a83900
- 22d ago Changed · -42 lines cc8d3a63a371
- 1mo ago Changed · +4 lines 9a121a0f794c
- 1mo ago Changed · +6 lines 353baa4bc54b
- 1mo ago Changed · +30 lines 78c021f57ee6
- 2mo ago First seen · 308 lines · 116 tokens per session scan A d380747dab18
govard-magento is a skill published in the GitHub repository ddtcorex/maestro-skills (5 stars, last pushed 3d ago), licensed MIT. It adds 116 tokens to every session and 4,247 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
marketplace-publish-validation
Corezoid marketplace pre-publication validator. Standalone skill — no external skill dependencies required. Use this skill whenever the user wants to publish, release, or submit a project or folder to the Corezoid marketplace, or asks to check if a project is ready to publish. Activate on phrases: "publish to…
magento-module-development
Build custom Magento 2 modules using dependency injection, plugins, observers, and service contracts to extend core functionality cleanly.
frappe-payments
Frappe Payments and ERPNext payment workflow guidance for payment gateways, payment requests, subscriptions, invoices, reconciliation, webhooks, and secure checkout flows. Use when work touches payments in Frappe or ERPNext.
magento-sql
Write safe, fast SQL in Magento 2 — Select builder, placeholders, batch ops, transactions, composite indexes, dbschema.xml best practices, whitelist, and MySQL 8 / MariaDB features (INSTANT DDL, invisible/functional indexes, histograms). Use when writing queries, designing indexes, diagnosing slow reads, or editing…
magento-agent-cron
Autonomously diagnose Magento 2 cron problems — jobs missed, stuck running, error spikes, cronschedule bloat, consumer-runner not draining queues, distributed-cron contention — and scaffold new cron jobs (crontab.xml + handler, optional admin-editable schedule). Produces a Cron Report with environment, root cause…
magento-agent-search
Autonomously diagnose Magento 2 catalog search problems — missing products, 0 results, wrong relevance, stuck reindex, cluster red/yellow, disk-watermark read-only — and advise on ES 7 → ES 8 or ES 7 → OpenSearch migrations. Produces a Search Report with engine, version, cluster health, root cause, fix, and…