Agent skill · security · aradotso
symfony-security-auditor
AI-powered multi-agent security auditor for Symfony applications using LLMs to detect business logic flaws, broken access control, and complex vulnerabilities
Why this skill is useful
Adds an AI-powered multi-agent security auditing capability specifically for Symfony applications, detecting complex vulnerabilities that traditional tools miss.
What it needs
Requires composer installed locally. Requires anthropic, google gemini, ollama, openai account access. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Symfony Security Auditor Skill Skill by ara.so — Security Skills collection. What It Does symfony-security-auditor is an AI-powered multi-agent security auditor for Symfony applications that catches vulnerabilities traditional SAST tools miss: Business logic flaws — authorization bypasses, workflow violations Broken access control — missing #[IsGranted], missing Voters, IDOR Complex injection chains — multi-file SQL injection, XSS, deserialization Mass assignment — unsafe MapRequestPayload, form handling Symfony-specific issues — firewall misconfigurations, unsafe Twig, Messenger handler flaws Uses a three-stage pipeline: 1. Ingestion — scans .php, .twig, .yaml, .xml recursively 2. Mapping — classifies Controllers, Entities, Voters, Forms, Routes 3. Audit — adversarial Attacker agent finds issues, skeptical Reviewer agent eliminates false positives over up to 3 iterations Outputs to console, JSON, SARIF (GitHub Code Scanning / GitLab Security Dashboard), or HTML. Provider-agnostic via symfony/ai — works with Claude, GPT, Gemini, Mistral, Llama, DeepSeek, Ollama. Installation With Symfony Flex (automatic setup) Flex automatically: Registers the bundle in config/bundles.php for dev and test environments Creates config/packages/symfonysecurityauditor.yaml with defaults Install an AI platform bridge Configure the AI platform Create or edit config/packages/ai.yaml: Set environment variables in .env.local: Manual setup (without Flex) Register bundles in config/bundles.php: Create config/packages/symfonysecurityauditor.yaml: Configuration Basic configuration Edit config/packages/symfonysecurityauditor.yaml: Split-model configuration (cost optimization) Use a powerful model for attack, cheap model for review: Cuts cost ~20× while maintaining high detection rate. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/symfony-security-auditor