Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ddtcorex/maestro-skillsnpx agentmods add skills/ddtcorex/maestro-skills/magento2-security-scanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan)<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/magento2-security-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ddtcorex/maestro-skills/magento2-security-scan"><img src="https://agentmods.dev/badge/skills/ddtcorex/maestro-skills/magento2-security-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.02209 |
| Opus 5 | $0.00053 | $0.01104 |
| Sonnet 5 | $0.00021 | $0.00442 |
| Haiku 4.5 | $0.00011 | $0.00221 |
Grade A, and why
magento2-security-scan scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -I https://store.test/app/etc/env.php How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Magento 2 Security Scanner
This skill performs security scanning for vulnerabilities, misconfigurations, and compliance issues.
Govard-Native Audit Coverage
govard audit run executes PHPCS and PHPStan through Govard's pinned lint
toolchain image — it covers coding-standard and static-analysis findings only.
As of Govard v1.64.0 no security audit check exists:
govard audit run --checks security fails with "audit check ... is not
implemented". The lint run does include a pub/media PHP guard since v1.64.0 — every PHP file
under pub/media is flagged (M2-LINT-MEDIA) — so a lint pass also covers that specific
file-drop attack surface, but it is still not a vulnerability scan. Run this skill's manual
checklist yourself and treat govard audit run --checks lint as the shared lint gate. Never
present a lint-only pass as a security verdict.
Related Skills
REQUIRED BACKGROUND: Load magento2-dev-core first — this skill scans for violations of the security patterns it defines (escaping, discouraged functions, ObjectManager misuse), and its patterns are what you fix findings with.
Part of the QA trio with magento2-linter (style/static analysis) and magento2-performance-audit (runtime/infrastructure). Re-check API/resolver-specific findings against magento2-backend-dev.
Vulnerability Categories
1. Injection Vulnerabilities
| Type | Pattern | Severity | Code |
|---|---|---|---|
| SQL Injection | Direct SQL with user input | Critical | M2-SEC-001 |
| XSS (Reflected) | Unescaped user input in output | High | M2-SEC-003 |
| XSS (Stored) | Unescaped database content | Critical | M2-SEC-002 |
| Command Injection | System command execution with user input | Critical | M2-SEC-004 |
Full scale and code catalogue: magento2-dev-core/references/severity-and-codes.md.
2. Authentication & Authorization
| Check | Command |
|---|---|
| Admin path changed | Check env.php for custom admin path |
| 2FA enabled | Check admin/twofactor module |
| Password hashing | Verify EncryptorInterface usage |
| Session security | Check cookie configuration |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 264 lines · 105 tokens per session scan A 2f2bd7f11175
magento2-security-scan is a skill published in the GitHub repository ddtcorex/maestro-skills (4 stars, last pushed yesterday), licensed MIT. It adds 105 tokens to every session and 2,209 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
marketplace-publish-validation
Corezoid marketplace pre-publication validator. Standalone skill — no external skill dependencies required. Use this skill whenever the user wants to publish, release, or submit a project or folder to the Corezoid marketplace, or asks to check if a project is ready to publish. Activate on phrases: "publish to…
frappe-payments
Frappe Payments and ERPNext payment workflow guidance for payment gateways, payment requests, subscriptions, invoices, reconciliation, webhooks, and secure checkout flows. Use when work touches payments in Frappe or ERPNext.
magento-sql
Write safe, fast SQL in Magento 2 — Select builder, placeholders, batch ops, transactions, composite indexes, dbschema.xml best practices, whitelist, and MySQL 8 / MariaDB features (INSTANT DDL, invisible/functional indexes, histograms). Use when writing queries, designing indexes, diagnosing slow reads, or editing…
magento-agent-cron
Autonomously diagnose Magento 2 cron problems — jobs missed, stuck running, error spikes, cronschedule bloat, consumer-runner not draining queues, distributed-cron contention — and scaffold new cron jobs (crontab.xml + handler, optional admin-editable schedule). Produces a Cron Report with environment, root cause…
magento-agent-search
Autonomously diagnose Magento 2 catalog search problems — missing products, 0 results, wrong relevance, stuck reindex, cluster red/yellow, disk-watermark read-only — and advise on ES 7 → ES 8 or ES 7 → OpenSearch migrations. Produces a Search Report with engine, version, cluster health, root cause, fix, and…
magento-agent-amqp
Autonomously diagnose Magento 2 message queue problems — backlog growth, stuck consumers, broker connectivity, DLQ overflow — and scaffold new queues (communication, topology, consumer, publisher) from a specification. Produces an AMQP Report with root cause and fix.