A development guide for extending Craft CMS 5, a PHP content-management system, with plugins and modules.

Use it to build or modify Craft plugins and modules, including custom elements, field types, services, migrations, commands, and tests.

It gives developers a common approach for adding server-side features such as fields, controllers, database changes, queues, and permissions.

craftcms — Skill for Claude Code by michtio/craftcms-claude-skills

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add michtio/craftcms-claude-skills --skill craftcms

Clone the repo

git clone --depth 1 https://github.com/michtio/craftcms-claude-skills

Made for: Claude Code.

Or install craftcms-claude-skills, the plugin that ships this one along with the rest of its 13 skills, 6 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/michtio/craftcms-claude-skills/craftcms/github.svg)](https://agentmods.dev/skills/michtio/craftcms-claude-skills/craftcms)

Your own site

<a href="https://agentmods.dev/skills/michtio/craftcms-claude-skills/craftcms"><img src="https://agentmods.dev/badge/skills/michtio/craftcms-claude-skills/craftcms/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/michtio/craftcms-claude-skills/craftcms"><img src="https://agentmods.dev/badge/skills/michtio/craftcms-claude-skills/craftcms.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 70 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 6,438 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00070	$0.06438
Opus 5.5	$0.00028	$0.02575
Sonnet 5.5	$0.00014	$0.01288
Haiku 4.5	$0.00007	$0.00644

Measured 17d ago against content hash f13ca7dce112, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

craftcms scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/craftcms/SKILL.md · 273 lines

How it starts

The opening of the file, as written. The whole thing — 273 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Craft CMS 5 — Extending (Plugins & Modules)

Reference for extending Craft CMS 5 through plugins and modules. Covers everything from elements and services to controllers, migrations, fields, and events.

This skill is scoped to extending Craft — building plugins, modules, custom element types, field types, and backend integrations. For site/platform development (content modeling, sections, entry types, Twig templating, plugin selection), see the craft-site skill.

Companion Skills — Always Load Together

When this skill triggers, also load:

craft-php-guidelines — PHPDoc standards, section headers, naming conventions, class organization, ECS/PHPStan, verification checklist. Required for any PHP code.
ddev — All commands run through DDEV. Required for running ECS, PHPStan, scaffolding, and tests.
craft-garnish — When working on CP JavaScript, asset bundles, or interactive CP components. Covers Garnish's class system, UI widgets (Modal, HUD, DisclosureMenu, Select), drag system, and the Craft.* JS class pattern.
craft-pest — When writing, running, fixing, or reviewing tests. Covers the markhuot/craft-pest-core harness, database isolation (its rollback is opt-in and its env overrides are cwd-bound — both cause silent writes to the dev database), factories, HTTP/queue/DB assertions, and CI test jobs.
craft-cloud — When the project is hosted on Craft Cloud (detect via craft-cloud.yaml at the repo root or craftcms/cloud in composer.json). Required for plugin Cloud-compatibility constraints — App::isEphemeral() guards, asset-bundle CDN publishing, 15-minute queue-job cap, csrfInput() function over raw token output, and the cloud/up deploy lifecycle events.

Documentation

Extend guide: https://craftcms.com/docs/5.x/extend/
Class reference: https://docs.craftcms.com/api/v5/
Generator: https://craftcms.com/docs/5.x/extend/generator.html

Use WebFetch on specific doc pages when a reference file doesn't cover enough detail.

Read the full file on GitHub · 273 lines

Files

What ships with it

31 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

17d ago Changed · +1 lines · -257 tokens per session f13ca7dce112
1mo ago Changed · +2 lines 3acd24f7264d
1mo ago First seen · 270 lines · 327 tokens per session scan A ce411b9f4096

Subscribe to this mod's changes

craftcms is a skill published in the GitHub repository michtio/craftcms-claude-skills (86 stars, last pushed 10d ago), licensed MIT. It adds 70 tokens to every session and 6,438 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Claude Code Languages PHP agent-skills claude-code-plugin claude-code-skills claude-skills content-modeling

php-ecosystem-reference

Use when picking a non-Laravel PHP tool — Symfony components, API Platform, or Slim — and routing to implementation. Do NOT use for Laravel (laravel-expert).

fusengine/agents · 42 tokens

php-http-psr

Use when building framework-agnostic PHP HTTP code — PSR-7/15/17/18 messages, middleware, factories, clients. Do NOT use for Laravel HTTP or Symfony HttpFoundation (not PSR-7).

fusengine/agents · 52 tokens

phx-quick

Implement small Phoenix changes without planning — add validations, update routes, fix components, create migrations. Use for single-file edits under 50 lines.

oliver-kriska/claude-elixir-phoenix · 34 tokens

symfony-domain-modeling

Symfony DDD domain modeling in pure PHP: entities, aggregates, value objects, domain events, domain exceptions, ID generation ports, PHP 8.2-8.5 modeling features (readonly, private(set), clone with). Use when: entity, value object, domain event, aggregate, domain exception, domain model, domain logic, business rule…

aligundogdu/symfony-hexagonal-skill · 81 tokens

symfony-validation

Symfony 3-layer validation in hexagonal architecture: Presentation request DTOs with #[MapRequestPayload], Application command validation via Messenger validation middleware, Domain invariants in value objects; custom constraints with named arguments, #[ExtendsValidationFor] (7.4+), validation groups. Use when…

aligundogdu/symfony-hexagonal-skill · 84 tokens

craft-middleware

Crafting package middleware. The invisible gatekeepers that guard, transform, and decorate every request.

attac-t/the-foundry · 23 tokens