magento2-security-scan

magento2-security-scan is a skill for Claude Code from ddtcorex/maestro-skills. It costs 105 tokens per session (2,209 once invoked), scanned A, original, MIT.

A checklist and linting procedure for reviewing Magento 2 code for security-related weaknesses and unsafe patterns. Magento 2 is a PHP-based ecommerce platform.

In plain words
What is it for?
Use it to inspect escaping, unsafe functions, ObjectManager usage, dependency issues, form protections, outdated packages, and other Magento security concerns.
Why use it?
It distinguishes code-quality checks from an actual security review, so a lint result is not mistaken for proof that the application is secure.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: mentions Codex; mentions OpenCode.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is govard sh -c "vendor/bin/magento-security-scanner scan ./app/code/Vendor/Module".

Part of the maestro-skills plugin — 31 skills shipped together

Good fit Use it to inspect escaping, unsafe functions, ObjectManager usage, dependency issues, form protections, outdated packages, and other Magento security concerns.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/ddtcorex/maestro-skills
agentmods
npx agentmods add skills/ddtcorex/maestro-skills/magento2-security-scan

Made for: Claude Code.

Or install maestro-skills, the plugin that ships this one along with the rest of its 31 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for magento2-security-scan

README.md
[![agentmods](https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/magento2-security-scan/github.svg)](https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan)
Your own site
<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/magento2-security-scan/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for magento2-security-scan

Your own site · 80×15
<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/magento2-security-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 105 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,209 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00105 $0.02209
Opus 5 $0.00053 $0.01104
Sonnet 5 $0.00021 $0.00442
Haiku 4.5 $0.00011 $0.00221

Measured 10d ago against content hash 2f2bd7f11175, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

magento2-security-scan scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -I https://store.test/app/etc/env.php
skills/magento2-security-scan/SKILL.md · 264 lines

How it starts

The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Magento 2 Security Scanner

This skill performs security scanning for vulnerabilities, misconfigurations, and compliance issues.

Govard-Native Audit Coverage

govard audit run executes PHPCS and PHPStan through Govard's pinned lint toolchain image — it covers coding-standard and static-analysis findings only. As of Govard v1.64.0 no security audit check exists: govard audit run --checks security fails with "audit check ... is not implemented". The lint run does include a pub/media PHP guard since v1.64.0 — every PHP file under pub/media is flagged (M2-LINT-MEDIA) — so a lint pass also covers that specific file-drop attack surface, but it is still not a vulnerability scan. Run this skill's manual checklist yourself and treat govard audit run --checks lint as the shared lint gate. Never present a lint-only pass as a security verdict.

REQUIRED BACKGROUND: Load magento2-dev-core first — this skill scans for violations of the security patterns it defines (escaping, discouraged functions, ObjectManager misuse), and its patterns are what you fix findings with.

Part of the QA trio with magento2-linter (style/static analysis) and magento2-performance-audit (runtime/infrastructure). Re-check API/resolver-specific findings against magento2-backend-dev.

Vulnerability Categories

1. Injection Vulnerabilities

Type Pattern Severity Code
SQL Injection Direct SQL with user input Critical M2-SEC-001
XSS (Reflected) Unescaped user input in output High M2-SEC-003
XSS (Stored) Unescaped database content Critical M2-SEC-002
Command Injection System command execution with user input Critical M2-SEC-004

Full scale and code catalogue: magento2-dev-core/references/severity-and-codes.md.

2. Authentication & Authorization

Check Command
Admin path changed Check env.php for custom admin path
2FA enabled Check admin/twofactor module
Password hashing Verify EncryptorInterface usage
Session security Check cookie configuration

Read the full file on GitHub · 264 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 264 lines · 105 tokens per session scan A 2f2bd7f11175

Subscribe to this mod's changes

magento2-security-scan is a skill published in the GitHub repository ddtcorex/maestro-skills (4 stars, last pushed yesterday), licensed MIT. It adds 105 tokens to every session and 2,209 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

marketplace-publish-validation

Corezoid marketplace pre-publication validator. Standalone skill — no external skill dependencies required. Use this skill whenever the user wants to publish, release, or submit a project or folder to the Corezoid marketplace, or asks to check if a project is ready to publish. Activate on phrases: "publish to…

corezoid/corezoid-ai-plugin · 160 tokens

frappe-payments

Frappe Payments and ERPNext payment workflow guidance for payment gateways, payment requests, subscriptions, invoices, reconciliation, webhooks, and secure checkout flows. Use when work touches payments in Frappe or ERPNext.

Dkm0315/frappe-agent · 49 tokens

magento-sql

Write safe, fast SQL in Magento 2 — Select builder, placeholders, batch ops, transactions, composite indexes, dbschema.xml best practices, whitelist, and MySQL 8 / MariaDB features (INSTANT DDL, invisible/functional indexes, histograms). Use when writing queries, designing indexes, diagnosing slow reads, or editing…

furan917/magento-ai-toolkit · 77 tokens

magento-agent-cron

Autonomously diagnose Magento 2 cron problems — jobs missed, stuck running, error spikes, cronschedule bloat, consumer-runner not draining queues, distributed-cron contention — and scaffold new cron jobs (crontab.xml + handler, optional admin-editable schedule). Produces a Cron Report with environment, root cause…

furan917/magento-ai-toolkit · 77 tokens

magento-agent-search

Autonomously diagnose Magento 2 catalog search problems — missing products, 0 results, wrong relevance, stuck reindex, cluster red/yellow, disk-watermark read-only — and advise on ES 7 → ES 8 or ES 7 → OpenSearch migrations. Produces a Search Report with engine, version, cluster health, root cause, fix, and…

furan917/magento-ai-toolkit · 81 tokens

magento-agent-amqp

Autonomously diagnose Magento 2 message queue problems — backlog growth, stuck consumers, broker connectivity, DLQ overflow — and scaffold new queues (communication, topology, consumer, publisher) from a specification. Produces an AMQP Report with root cause and fix.

furan917/magento-ai-toolkit · 59 tokens