What is magento-security?

A security guide for Magento 2, an e-commerce platform. It covers protections such as content security policy, two-factor authentication, request forgery protection, admin permissions, input validation, and secure configuration.

Use it to harden a Magento installation, configure allowed browser resources, protect admin accounts, validate input, and review security settings.

It helps prevent common attacks, including injected scripts, forged requests, and unauthorized admin access. It also explains where Magento security controls are configured.

magento-security — Skill for Claude Code by OrcaQubits

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add OrcaQubits/agentic-commerce-skills-plugins --skill magento-security

Clone the repo

git clone --depth 1 https://github.com/OrcaQubits/agentic-commerce-skills-plugins

Made for: Claude Code.

Or install magento2-commerce, the plugin that ships this one along with the rest of its 19 skills, 1 agent.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security/github.svg)](https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security)

Your own site

<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/magento-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 891 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00046	$0.00891
Opus 5.5	$0.00018	$0.00356
Sonnet 5.5	$0.00009	$0.00178
Haiku 4.5	$0.00005	$0.00089

Measured 1mo ago against content hash a50cc98fad93, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

magento-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

magento2-commerce/skills/magento-security/SKILL.md · 106 lines

How it starts

The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Magento 2 Security

Before writing code

Fetch live docs:

Web-search site:experienceleague.adobe.com commerce security for security best practices
Web-search site:developer.adobe.com commerce php development security for developer security guide
Web-search magento 2 security patches latest for recent security updates

Content Security Policy (CSP)

What It Does

Protects against XSS and code injection by restricting which resources (scripts, styles, images, fonts) can load.

Configuration

etc/csp_whitelist.xml — whitelist external domains per CSP directive
Modes: report-only (logs violations) and restrict (blocks violations)
Directives: script-src, style-src, img-src, font-src, connect-src, frame-src

Adding Allowed Sources

Whitelist third-party domains for payment gateways, analytics, CDNs:

Declare in csp_whitelist.xml under the appropriate directive
Use report-only mode first to identify missing whitelists

Two-Factor Authentication (2FA)

Mandatory for all admin users since Magento 2.4.0
Supported providers: Google Authenticator, Duo Security, Authy, U2F keys
Rate limiting on OTP validation (configurable retry limit and lockout)
Cannot be disabled in production (security requirement)

CSRF Protection

form_key — 16-character token included in all admin forms
Validated on every POST request in admin
SameSite cookie attribute prevents cross-site request forgery
Admin Secret Key in URLs adds additional protection

Admin Security Configuration

Available at Stores > Settings > Configuration > Advanced > Admin > Security:

Custom admin URL path (obscure the /admin path)
Add Secret Key to URLs
Password lifetime (force periodic changes)
Max login failures before lockout
Lockout duration
Session lifetime
Allowed countries for admin access

Input Validation and Output Escaping

Input Validation

Validate all user input on the server side
Use Magento's validation classes and form validators
Never trust client-side validation alone
Validate types, lengths, formats, and allowed values

Read the full file on GitHub · 106 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 106 lines · 46 tokens per session scan A a50cc98fad93

Subscribe to this mod's changes

magento-security is a skill published in the GitHub repository OrcaQubits/agentic-commerce-skills-plugins (40 stars, last pushed 1mo ago), licensed MIT. It adds 46 tokens to every session and 891 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.

Magento Security a2a acp agentic-commerce ucp webmcp

magento-security next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
magento-securityOrcaQubits/agentic-commerce-skills-plugins	Skill	40	1mo ago	MIT	A	46	Claude Code
metengine-data-agentinternet-court/internet-court-skill	Skill	7.1k	11d ago	none	A	57	Claude Code
internet-courtinternet-court/internet-court-skill	Skill	7.1k	11d ago	none	A	147	Claude Code
okx-agent-payments-protocolinternet-court/internet-court-skill	Skill	7.1k	11d ago	none	A	231	Claude Code
intelligent-oracleinternet-court/internet-court-skill	Skill	7.1k	11d ago	none	A	44	Claude Code
lifiinternet-court/internet-court-skill	Skill	7.1k	11d ago	none	A	299	Claude Code
archestra-docs-writerarchestra-ai/archestra	Skill	4.4k	today	none	A	51	Claude Code, Codex