Symfony AI Demo is a Symfony application that demonstrates AI components through a chatbot using OpenAI language and embedding models, with PostgreSQL and pgvector storing contextual embeddings. Developers use it to explore a Symfony-based AI application and its setup.
Borrowing it
Nothing to install: this file belongs to symfony/ai-demo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/symfony/ai-demo/main/.agents/skills/mate-symfony-service-inspection/SKILL.mdgit clone --depth 1 https://github.com/symfony/ai-demoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection)<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-service-inspection/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-service-inspection.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01450 |
| Opus 5.5 | $0.00032 | $0.00580 |
| Sonnet 5.5 | $0.00016 | $0.00290 |
| Haiku 4.5 | $0.00008 | $0.00145 |
Grade A, and why
mate-symfony-service-inspection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Service inspection
Reads the compiled DI container through Mate's CLI, from the dumped *DebugContainer.xml. Two tools:
symfony-services(optquery,tag,limit):queryis a case-insensitive partial match on service id OR class;tagis an exact tag name. Returns{services: {id => class}, count, truncated}.countis the number of matches before the cut,truncatedsays whetherlimit(default 100) hid some. Narrow the filter rather than raisinglimit.symfony-service-detail --id=<exact id>: full detail for one service,{id, class, public, synthetic, lazy, shared, abstract, autowired, autoconfigured, tags, calls, arguments, factory?}. The id must be exact.
Both commands accept --format: json to parse the result, toon (when helgesverre/toon is installed) for the smallest context footprint. The service map can be large, so filter it rather than dumping it wide.
Workflow
- Locate candidates with
symfony-services, filtered. Never dump the whole container.- By class or interface:
vendor/bin/mate tools:call symfony-services --query=MailerInterface - By id fragment:
--query=app.handler - By tag, to see who participates in a hook:
vendor/bin/mate tools:call symfony-services --tag=kernel.event_listener
- By class or interface:
- Take the exact id from that map and read it:
vendor/bin/mate tools:call symfony-service-detail --id=App\\Mailer\\Mailer. - Interpret against the symptom below.
Reading
- Wrong implementation injected: query the interface. Every id mapping to a class is a candidate. The one wired in is usually the alias whose id equals the interface FQCN. Aliases are resolved for you: asking for the alias id returns the target's class, tags, and calls, so
detailon the interface id shows the concrete class that actually gets injected. - Tag not applied (listener/subscriber/extension silent):
detailthe service and checktags. If the expected tag is absent, autoconfiguration did not fire:autoconfigured: falsesays so directly, otherwise the class does not implement the expected interface/attribute. Each tag entry carries its attributes (event,priority,method, ...); a listener bound to the wrongeventorpriorityis a common cause. - Class in a resource glob but not registered as expected:
detailthe FQCN. The boolean flags are the effective values of the compiled definition, the samedebug:container <id>reports (synthetic: truemeans the object is set at runtime, e.g.kernel, so there is no class wiring to inspect).abstract: truewith acontainer.excludedtag means the container holds a placeholder instead of a service. When the tag has asource, it narrows the cause:in "config/services.yaml"names the file whose glob skipped the class, either through itsexcludepattern or because the class carries#[Exclude]/ a non-matching#[When](check the class before hunting for a pattern);because the class is abstractandby tag "..."speak for themselves. To check one class, usesymfony-services --tag=container.excluded --query=<class>; the unfiltered tag listing is cut atlimit. - Constructor/factory surprise:
factory(present only when set) isClass::method, telling you the object is built by a factory, notnew.callslists setter-injection method names invoked after construction. A dependency that is null at runtime is often a missing setter call here. - What is actually wired in:
argumentsis the constructor argument list in declaration order, each{name, type, value}.type: service:valueis the referenced service id. Feed it straight back into--id=to walk one level deeper.type: collection:valueis a nested list of the same shape. This is where a list of collaborators lives, and it is usually the answer to "which of these is registered": the middleware on a messenger bus, the handlers on a chain, the wrapped services of a decorator.type: scalar: a literal, or a description likeall services tagged "app.plugin"for a tagged iterator.namecomes from the constructor (or factory method) signature. A name like#3means the position could not be matched to a parameter: the class is not loadable, or it is built by a factory service that records no class.value: ***REDACTED***means the parameter name looked like a secret (key,password,token,secret,auth,dsn,url, …) or the parameter could not be identified. Service ids and collections are never redacted, so wiring stays readable either way. If you need the literal, read the config that sets it, not this tool.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 43 lines · 81 tokens per session scan A 8ba51028c17a
mate-symfony-service-inspection is a skill published in the GitHub repository symfony/ai-demo (48 stars, last pushed 2d ago), licensed MIT. It adds 81 tokens to every session and 1,450 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
system-information
Resolve which dependency versions are actually installed, from composer show and composer.lock, when diagnosing version-specific behavior such as a method, argument or class that does not exist in the release that is really running. For the PHP runtime itself (version, OS, loaded extensions) use the…
mem0-status
Diagnoses mem0 connectivity, API key validity, and memory read/write functionality. Use when memory operations fail, searches return empty, addmemory errors occur, or to verify the plugin is working correctly.
rest-graphql-debug
Debug REST/GraphQL APIs: status codes, auth, schemas, repro.
data-fetching
Use when implementing or debugging ANY network request, API call, or data fetching. Covers fetch API, axios, React Query, SWR, error handling, caching strategies, offline support.
debugging-mutations
Verify what changed on a ServiceNow instance after a tool call — sysaudit inspection, syslog/transaction logs, session context, Flow Designer execution logs, outbound HTTP traces.
xurl-api-probing
Probe APIs directly and methodically before assuming the client or app layer is at fault.