Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/shopwarelabs/ai-coding-tools/xml-config-migratingnpx skills add shopwareLabs/ai-coding-tools --skill xml-config-migratinggit clone --depth 1 https://github.com/shopwareLabs/ai-coding-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shopwarelabs/ai-coding-tools/xml-config-migrating)<a href="https://agentmods.dev/skills/shopwarelabs/ai-coding-tools/xml-config-migrating"><img src="https://agentmods.dev/badge/skills/shopwarelabs/ai-coding-tools/xml-config-migrating.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.04878 |
| Opus 5 | $0.00053 | $0.02439 |
| Sonnet 5 | $0.00021 | $0.00976 |
| Haiku 4.5 | $0.00011 | $0.00488 |
Grade A, and why
xml-config-migrating scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate Shopware Extension XML Configuration to PHP
Shopware 6.7 deprecates loading Symfony configuration from XML for bundles and plugins; Shopware 6.8 removes it, because Symfony 8 drops the XML loaders entirely. Extensions that still ship XML config break with 6.8.
The migration is mechanical and behavior-neutral: the compiled container and route collection stay identical apart from what verify-dumps.sh classifies as inert. A tool-computed verdict is the only verdict that enters the report.
Scope
| In scope | Out of scope (Shopware-specific XML formats — keep as XML) |
|---|---|
src/Resources/config/services.xml, services_test.xml |
Resources/config/config.xml (plugin settings) |
src/Resources/config/routes.xml, routes_<env>.xml, routes_overwrite.xml, any XML under Resources/config/routes/ |
Resources/config/custom-fields.xml, flow.xml, rule-conditions.xml |
src/Resources/config/packages/**/*.xml |
App manifest.xml |
packages/** config is loaded only by a bundle that calls buildDefaultConfig(), which in Shopware is its own core bundles and nothing else; a plugin's packages files are inert unless the extension loads them itself. They stay in scope regardless — dead XML is still XML that has to be gone before 6.8 — but nothing in this workflow can observe their content, so Step 7 and Step 10 treat a packages row differently from every other row.
Prerequisites
- A working Shopware installation (6.6+) with the extension installed and active, and
bin/consoleworking. Run every console command through the project's development environment. jqavailable on the host forverify-dumps.sh.- The dump directory and the extension sources readable from where the bundled scripts run.
${CLAUDE_SKILL_DIR} is this skill's own directory; on a host that does not define it, substitute the path to this skill's directory.
Workflow
digraph xml_config_migrating {
"Skill invoked" [shape=doublecircle];
"Step 1: Inventory (inventory.sh)" [shape=box];
"Inventory empty?" [shape=diamond];
"STOP — report: nothing to migrate" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
"Step 2: Baseline dumps" [shape=box];
"Step 3: Migrate one XML file to one PHP file" [shape=box];
"Step 4: Import pre-check (check-class-imports.sh)" [shape=box];
"Imports complete?" [shape=diamond];
"Step 5: Add the missing imports" [shape=box];
"Step 6: After dumps" [shape=box];
"Step 7: Verify (verify-dumps.sh)" [shape=box];
"verify-dumps.sh exit 0?" [shape=diamond];
"Step 8: Fix the PHP file" [shape=box];
"Step 9: Tests and deprecation gate" [shape=box];
"Tests and gate pass?" [shape=diamond];
"Step 10: Report" [shape=box];
"Report: migration verified" [shape=doublecircle];
"Report: NOT done" [shape=doublecircle];
"Skill invoked" -> "Step 1: Inventory (inventory.sh)";
"Step 1: Inventory (inventory.sh)" -> "Inventory empty?";
"Inventory empty?" -> "STOP — report: nothing to migrate" [label="yes"];
"Inventory empty?" -> "Step 2: Baseline dumps" [label="no"];
"Step 2: Baseline dumps" -> "Step 3: Migrate one XML file to one PHP file";
"Step 3: Migrate one XML file to one PHP file" -> "Step 4: Import pre-check (check-class-imports.sh)";
"Step 4: Import pre-check (check-class-imports.sh)" -> "Imports complete?";
"Imports complete?" -> "Step 5: Add the missing imports" [label="no"];
"Step 5: Add the missing imports" -> "Step 4: Import pre-check (check-class-imports.sh)";
"Imports complete?" -> "Step 6: After dumps" [label="yes"];
"Step 6: After dumps" -> "Step 7: Verify (verify-dumps.sh)";
"Step 7: Verify (verify-dumps.sh)" -> "verify-dumps.sh exit 0?";
"verify-dumps.sh exit 0?" -> "Step 8: Fix the PHP file" [label="no"];
"Step 8: Fix the PHP file" -> "Step 6: After dumps";
"verify-dumps.sh exit 0?" -> "Step 9: Tests and deprecation gate" [label="yes"];
"Step 9: Tests and deprecation gate" -> "Tests and gate pass?";
"Tests and gate pass?" -> "Report: NOT done" [label="no"];
"Tests and gate pass?" -> "Step 10: Report" [label="yes"];
"Step 10: Report" -> "Report: migration verified";
}
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 204 lines · 106 tokens per session scan A a8e98733ec15
xml-config-migrating is a skill published in the GitHub repository shopwareLabs/ai-coding-tools (43 stars, last pushed yesterday), licensed MIT. It adds 106 tokens to every session and 4,878 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
build-priority-queue
For ordered processing: A search, Dijkstra, event simulation, task scheduling. Efficient min/max extraction with heap-based queue.
cache-recursive-calls
For dynamic programming: overlapping subproblems, recursive solutions with repeated computations, memoization to avoid redundant work.
catch-expected-errors
For iteration with errors: catch exceptions during exploration, skip invalid cases, continue to next attempt.
intern-symbols-identity
For fast comparison: ensure only one instance of each symbol, use 'is' instead of '==', symbol tables for interpreters.
iterate-with-itertools
For combinatorial iteration: permutations, combinations, cartesian products, without storing all results in memory.
overload-operators-dsl
For domain-specific languages: operator overloading, make Python look like math/domain notation, expression builders.