ai-demo: Skill for Claude Code

.agents/skills/mate-symfony-service-inspection/SKILL.md

mate-symfony-service-inspection is a skill for Claude Code, Codex from symfony/ai-demo. It costs 81 tokens per session (1,450 once invoked), scanned A, original, MIT.

A Symfony dependency-injection inspection tool. Symfony dependency injection is the system that builds and connects application services; this tool examines its compiled service container and wiring details.

In plain words
What is it for?
Use it to search services by identifier, class, or tag, then inspect one service's visibility, arguments, tags, and related settings.
Why use it?
It helps find why a service cannot be found, the wrong class is being used, a tag was not applied, or a factory or decorator is not working.

Skill for Claude CodeCodex ✓ vendor

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is symfony/ai-demo's own configuration. It tells Claude Code and Codex how to work on ai-demo itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything ai-demo configures →

About the project

Symfony AI Demo is a Symfony application that demonstrates AI components through a chatbot using OpenAI language and embedding models, with PostgreSQL and pgvector storing contextual embeddings. Developers use it to explore a Symfony-based AI application and its setup.

symfony/ai-demo · 48 stars · on GitHub · symfony.com

Reuse

Borrowing it

Nothing to install: this file belongs to symfony/ai-demo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/symfony/ai-demo/main/.agents/skills/mate-symfony-service-inspection/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/symfony/ai-demo

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for mate-symfony-service-inspection

README.md
[![agentmods](https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-service-inspection/github.svg)](https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection)
Your own site
<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-service-inspection/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for mate-symfony-service-inspection

Your own site · 80×15
<a href="https://agentmods.dev/skills/symfony/ai-demo/mate-symfony-service-inspection"><img src="https://agentmods.dev/badge/skills/symfony/ai-demo/mate-symfony-service-inspection.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 81 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,450 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00081 $0.01450
Opus 5.5 $0.00032 $0.00580
Sonnet 5.5 $0.00016 $0.00290
Haiku 4.5 $0.00008 $0.00145

Measured 1mo ago against content hash 8ba51028c17a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

mate-symfony-service-inspection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/mate-symfony-service-inspection/SKILL.md · 43 lines

How it starts

The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Service inspection

Reads the compiled DI container through Mate's CLI, from the dumped *DebugContainer.xml. Two tools:

  • symfony-services (opt query, tag, limit): query is a case-insensitive partial match on service id OR class; tag is an exact tag name. Returns {services: {id => class}, count, truncated}. count is the number of matches before the cut, truncated says whether limit (default 100) hid some. Narrow the filter rather than raising limit.
  • symfony-service-detail --id=<exact id>: full detail for one service, {id, class, public, synthetic, lazy, shared, abstract, autowired, autoconfigured, tags, calls, arguments, factory?}. The id must be exact.

Both commands accept --format: json to parse the result, toon (when helgesverre/toon is installed) for the smallest context footprint. The service map can be large, so filter it rather than dumping it wide.

Workflow

  1. Locate candidates with symfony-services, filtered. Never dump the whole container.
    • By class or interface: vendor/bin/mate tools:call symfony-services --query=MailerInterface
    • By id fragment: --query=app.handler
    • By tag, to see who participates in a hook: vendor/bin/mate tools:call symfony-services --tag=kernel.event_listener
  2. Take the exact id from that map and read it: vendor/bin/mate tools:call symfony-service-detail --id=App\\Mailer\\Mailer.
  3. Interpret against the symptom below.

Reading

  • Wrong implementation injected: query the interface. Every id mapping to a class is a candidate. The one wired in is usually the alias whose id equals the interface FQCN. Aliases are resolved for you: asking for the alias id returns the target's class, tags, and calls, so detail on the interface id shows the concrete class that actually gets injected.
  • Tag not applied (listener/subscriber/extension silent): detail the service and check tags. If the expected tag is absent, autoconfiguration did not fire: autoconfigured: false says so directly, otherwise the class does not implement the expected interface/attribute. Each tag entry carries its attributes (event, priority, method, ...); a listener bound to the wrong event or priority is a common cause.
  • Class in a resource glob but not registered as expected: detail the FQCN. The boolean flags are the effective values of the compiled definition, the same debug:container <id> reports (synthetic: true means the object is set at runtime, e.g. kernel, so there is no class wiring to inspect). abstract: true with a container.excluded tag means the container holds a placeholder instead of a service. When the tag has a source, it narrows the cause: in "config/services.yaml" names the file whose glob skipped the class, either through its exclude pattern or because the class carries #[Exclude] / a non-matching #[When] (check the class before hunting for a pattern); because the class is abstract and by tag "..." speak for themselves. To check one class, use symfony-services --tag=container.excluded --query=<class>; the unfiltered tag listing is cut at limit.
  • Constructor/factory surprise: factory (present only when set) is Class::method, telling you the object is built by a factory, not new. calls lists setter-injection method names invoked after construction. A dependency that is null at runtime is often a missing setter call here.
  • What is actually wired in: arguments is the constructor argument list in declaration order, each {name, type, value}.
    • type: service: value is the referenced service id. Feed it straight back into --id= to walk one level deeper.
    • type: collection: value is a nested list of the same shape. This is where a list of collaborators lives, and it is usually the answer to "which of these is registered": the middleware on a messenger bus, the handlers on a chain, the wrapped services of a decorator.
    • type: scalar: a literal, or a description like all services tagged "app.plugin" for a tagged iterator.
    • name comes from the constructor (or factory method) signature. A name like #3 means the position could not be matched to a parameter: the class is not loadable, or it is built by a factory service that records no class.
    • value: ***REDACTED*** means the parameter name looked like a secret (key, password, token, secret, auth, dsn, url, …) or the parameter could not be identified. Service ids and collections are never redacted, so wiring stays readable either way. If you need the literal, read the config that sets it, not this tool.

Read the full file on GitHub · 43 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 43 lines · 81 tokens per session scan A 8ba51028c17a

Subscribe to this mod's changes

mate-symfony-service-inspection is a skill published in the GitHub repository symfony/ai-demo (48 stars, last pushed 2d ago), licensed MIT. It adds 81 tokens to every session and 1,450 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.