Symfony Security Auditor Skill

Skill by ara.so — Security Skills collection.

What It Does

symfony-security-auditor is an AI-powered multi-agent security auditor for Symfony applications that catches vulnerabilities traditional SAST tools miss:

• Business logic flaws — authorization bypasses, workflow violations
• Broken access control — missing #[IsGranted], missing Voters, IDOR
• Complex injection chains — multi-file SQL injection, XSS, deserialization
• Mass assignment — unsafe MapRequestPayload, form handling
• Symfony-specific issues — firewall misconfigurations, unsafe Twig, Messenger handler flaws

Uses a three-stage pipeline:

1. Ingestion — scans .php, .twig, .yaml, .xml recursively
2. Mapping — classifies Controllers, Entities, Voters, Forms, Routes
3. Audit — adversarial Attacker agent finds issues, skeptical Reviewer agent eliminates false positives over up to 3 iterations