Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add krzysztofsurdy/code-virtuoso --skill symfony-componentsgit clone --depth 1 https://github.com/krzysztofsurdy/code-virtuosoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/symfony-components)<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/symfony-components"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/symfony-components/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/symfony-components"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/symfony-components.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.02839 |
| Opus 5.5 | $0.00017 | $0.01136 |
| Sonnet 5.5 | $0.00008 | $0.00568 |
| Haiku 4.5 | $0.00004 | $0.00284 |
Grade A, and why
symfony-components scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Symfony components
Symfony ships a new minor release twice a year and its APIs move. This skill does not restate the API. It tells you which version you are on, where to fetch the exact API for that version, which defaults to prefer when the docs offer several options, and which mistakes recur in real projects.
Core principles
| Principle | Meaning |
|---|---|
| Version first | Read the installed version before suggesting any API. Memory of "Symfony 7" is often stale. |
| Docs over memory | Fetch the page for the component and version you need. Do not paste API from recall. |
| Attributes and autowiring | Prefer PHP attributes and autowiring. Use YAML or XML only for what attributes cannot express. |
| Fail loudly, run long | Code must survive long-running workers: no leaked state, idempotent handlers. |
| Zero deprecations | Treat deprecation notices as a ratchet. They are the upgrade path to the next major. |
Step 1: find the installed version
Read it from composer.lock, not from composer.json constraints (^7.2 says little).
jq -r '.packages[] | select(.name|test("^symfony/(framework-bundle|http-kernel)$")) | .name+" "+.version' composer.lock
Also check the php constraint in composer.json and the CLI version. A project on 6.4 or 7.4 needs different answers than one on 8.1: attribute names moved, features landed, and some APIs were removed in 8.0.
Version matrix
Verified 2026-10-21 against https://symfony.com/releases.
| Branch | Status | Minimum PHP | Support ends |
|---|---|---|---|
| 8.1 | Current stable, not LTS | 8.4 | January 2027 (bugs and security) |
| 8.2 | In development, planned November 2026 | 8.4 | July 2027 |
| 7.4 | LTS | 8.2 | Bugs November 2028, security November 2029 |
| 6.4 | LTS | 8.1 | Bugs November 2026, security November 2027 |
| 8.0 | Unmaintained | 8.4 | Ended July 2026 |
| 5.4 | Security fixes only | 7.2.5 | February 2029 |
Rules of thumb:
- Minor versions of a major are non-LTS and live about 8 months. LTS versions end in
.4. By that pattern 8.4 is the next LTS (not confirmed on the releases page). - Moving from 7.4 to 8.x means moving to PHP 8.4 first. Do not write 8.x-only syntax for a project on 7.4 or 6.4.
- Do not state "PHP 8.3+" or "Symfony 7.x" as the baseline. Use the project's own constraint.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 9a738e5a3a49
- 2d ago Changed · -77 lines · -55 tokens per session 0961be4dbb1d
- 1mo ago First seen · 219 lines · 97 tokens per session scan A bb9c1c5becc6
symfony-components is a skill published in the GitHub repository krzysztofsurdy/code-virtuoso (36 stars, last pushed yesterday), licensed MIT. It adds 42 tokens to every session and 2,839 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mvc-expert
Expert guidelines to refactor legacy PHP codebases into clean, modern, and scalable MVC-structured projects / Pedoman ahli untuk merefaktor codebase PHP lama menjadi proyek terstruktur MVC yang bersih, modern, dan skalabel.
bd-better-route-bridge
Compose better-data DTOs with the better-route library — use BetterRouteBridge::{get, post, put, patch, delete} to register a REST route that hydrates the request into a DTO, validates, calls the handler with (DataObject, mixed $request), and presents returned DataObject values through Presenter with…
bd-data-object
Add or modify DataObject subclasses inside the better-data library — the immutable, attribute-decorated DTOs the whole library is built around. Every DTO is final readonly class extends DataObject with constructor-promoted typed parameters; sources hydrate via ::fromArray, sinks project via SinkProjection, the…
bd-hydration-coercion
Modify how raw values become typed property values in better-data — work in TypeCoercer (primitives + DateTime + Enum + Secret) or DataObject::coerceParameter (attribute-aware — ListOf, Encrypted, etc.). Critical layering — TypeCoercer is pure, must stay callable from a no-WordPress unit test, no side effects, no…
bd-source-adapter
Add a new source adapter to better-data — code that reads from a WordPress data store the library doesn't cover yet (comments, attachments, transients, custom tables). Mirror the canonical shape PostSource / UserSource / TermSource use — a non-final class with static hydrate(int|object, $dtoClass) and…
wp-plugin-architecture
Designs and reviews the internal architecture of a WordPress plugin — src/ folder layout, Composer PSR-4 one-class-per-file discipline, PascalCase filenames matching class names, no class-.php legacy layout, Schema/Constants placement, composition-root vs singleton decisions, conditional asset enqueueing, script…