Symfony AI Demo is a Symfony application that demonstrates AI components through a chatbot using OpenAI language and embedding models, with PostgreSQL and pgvector storing contextual embeddings. Developers use it to explore a Symfony-based AI application and its setup.
Borrowing it
Nothing to install: this file belongs to symfony/ai-demo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/symfony/ai-demo/main/.agents/skills/mate-symfony-dotenv-diagnostics/SKILL.mdgit clone --depth 1 https://github.com/symfony/ai-demoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-dotenv-diagnostics)<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-dotenv-diagnostics"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-dotenv-diagnostics/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-dotenv-diagnostics"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-dotenv-diagnostics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.01068 |
| Opus 5.5 | $0.00037 | $0.00427 |
| Sonnet 5.5 | $0.00019 | $0.00214 |
| Haiku 4.5 | $0.00009 | $0.00107 |
Grade A, and why
mate-symfony-dotenv-diagnostics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dotenv diagnostics
symfony-dotenv-check (opt key, limit) reports, for each environment variable declared across
the project's .env* files: which file(s) declare it, whether it resolves to a non-empty value in
Mate's own CLI process right now, and where that value actually comes from. It never returns a raw
value — only length (character count) and preview (a fixed x***y first/last-character mask,
or ** for anything 2 characters or shorter), plus a best-effort looks_like_placeholder guess.
Without a key, it lists every variable found across the discovered files ({app_env, files, variables, count, truncated}). With key, it checks exactly that one variable name, even if no
file declares it — the way to confirm a name you only saw elsewhere (a leaked log line, a
%env(FOO)% reference in config) is real, without asking Mate to print it.
Why not debug:dotenv
bin/console debug:dotenv prints the fully resolved, unmasked value of every variable it finds,
including ones that only resolve because the ambient shell or CI environment happens to carry a
real secret rather than any file in the project. That is exactly the failure mode this tool
removes: it gives the same diagnostic value (declared where, resolves or not) without ever putting
a real secret value in the output or an agent's transcript.
Reading state
file: resolves, and the resolved value matches what a project file declares. The expected, healthy case.ambient_override: resolves, declared in a file, but the resolved value does not match any declared file — the real value is coming from outside the project (shell export, CI secret, Docker env, a global profile). Worth a second look if you did not expect an override here.ambient_only: resolves, but is declared in no project file at all. Only reachable via thekeyparameter (the default listing only enumerates file-declared keys). This is the case that caused the original leak this tool replaces: a real secret sitting only in the ambient environment, invisible to the project's own.env*files.declared_empty_in_file: declared in a file, but the winning file's own value is the empty string (e.g.KEY=left blank, expecting an override that never happened) — a fact about file content, not about the current process.declared_not_resolved_in_this_process: declared with a non-empty value in a file, but does not resolve in Mate's own CLI process. This is not necessarily broken: Mate'sbin/mateprocess does not boot the target application's own Dotenv, so this state simply means the file value was not independently exported into the shell Mate is running in. Cross-check by running the app (orbin/console debug:dotenv, mindful that it prints raw values) if this surprises you.not_set: only reachable viakey— the name resolves nowhere and is declared in no file.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 67 lines · 93 tokens per session scan A 1e262678ce37
mate-symfony-dotenv-diagnostics is a skill published in the GitHub repository symfony/ai-demo (48 stars, last pushed 2d ago), licensed MIT. It adds 93 tokens to every session and 1,068 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
system-information
Resolve which dependency versions are actually installed, from composer show and composer.lock, when diagnosing version-specific behavior such as a method, argument or class that does not exist in the release that is really running. For the PHP runtime itself (version, OS, loaded extensions) use the…
php-environment-check
Check the PHP runtime with server-info, its version, OS, and loaded extensions. Reach for it when a Mate tool itself fails or a capability is missing and you suspect the environment, a missing extension or an old PHP, rather than the app or its config. Not for diagnosing app behavior (profiler, log investigation) or…
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
triage-issues
Triage GitHub issues in the googleapis/mcp-toolbox repo: propose the correct labels (type / priority / product / status), check for duplicates, verify a bug has enough info to act on, and draft a triage comment. Use whenever a maintainer asks you to triage, label, categorize, prioritize, or "look at" an issue (or a…
python-debugpy
Debug Python: pdb REPL + debugpy remote (DAP).