New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Hardening Rule

by symfony in symfony/symfony

Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps.

MITAuto-check passedDevelopment

Install Hardening Rule

skills CLI
$ npx skills add symfony/symfony --skill hardening-rule -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install symfony/symfony hardening-rule --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/symfony/symfony.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/hardening-rule .claude/skills/hardening-rule && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hardening-rule
GitHub stars
31k
Token cost
~1.2k tokens
SKILL.md length
598 words
Files
1
Skills in repo
9
Repo updated
First seen
Licence
MIT

At a glance

Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps.

  • Works in 3 steps: Registration is one line plus the file.… → phpstan analyse counts are… → The diff-lint only flags new errors.…
  • The user says write a PHPStan rule
  • SKILL.md covers When to build (and when not), The shape (copy, do not…, The traps and Convention path, plus 1 more section
  • Calls composer

What it does

Hardening Rule is an agent skill from symfony/symfony. Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps. Covers PHPStan custom rules (implementation-shape checks) and the check-hardening-tests.php convention (test-presence checks). Use when the user says "write a PHPStan rule", "add a hardening rule", "gate this pattern", "catch this in CI", or wants to turn a finding into a durable check.

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development. It works with Symfony, PHP and GitHub. The repository describes itself as: The Symfony PHP framework. The licence is MIT.

When your agent uses it

  • The user says write a PHPStan rule
  • Add a hardening rule
  • Gate this pattern
  • Catch this in CI

Example prompts

  • “write a PHPStan rule”
  • “add a hardening rule”
  • “gate this pattern”
  • “/hardening-rule”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Registration is one line plus the file. Drop Rule.php into
  2. phpstan analyse counts are nondeterministic (result cache + parallel workers report
  3. The diff-lint only flags new errors. phpstan-diff.php compares the PR against the

What it can do on your machine

Read from SKILL.md and the folder at commit af79aa7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • composer

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hardening Rule loads about 1.2k tokens when it runs. Until then it costs about 102 tokens; SKILL.md has 598 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~102
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from symfony/symfony at commit af79aa7, republished under its MIT licence (© symfony). 598 words, ~1,172 tokens.

Download SKILL.mdSave it as .claude/skills/hardening-rule/SKILL.md (or your agent's skills folder).
name
hardening-rule
description
Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps. Covers PHPStan custom rules (implementation-shape checks) and the check-hardening-tests.php convention (test-presence checks). Use when the user says "write a PHPStan rule", "add a hardening rule", "gate this pattern", "catch this in CI", or wants to turn a finding into a durable check.

Symfony Hardening Rule

Turns a recurring hardening invariant into a CI gate. The mechanics are obvious from the three shipped rules (HardenedComparisonRule, UnserializeToStringTrampolineRule, UnserializeMissingAllowedClassesRule): copy the class shape and the registration. This skill is the part the example files cannot teach: when a rule is worth building, and the traps that cost an afternoon.

When to build (and when not)

A PHPStan rule earns its place only if it catches a broad, recurring shape across many sites. The shipped rules each span dozens (every webhook compare; 60+ __unserialize; every unserialize()). If your rule effectively targets one class or one call site, it is too narrow: it carries CI weight for almost no coverage. Use a regression test instead. (A verify-MAC-before-deserialize rule was built and dropped for exactly this reason: it matched a single serializer.)

Pick the mechanism by what the invariant is about:

Invariant is about...Use
A code shape recurring across many sitesa PHPStan rule (this skill)
A test existing for a boundary classextend check-hardening-tests.php
A value being attacker-controlled (data-flow)Psalm taint, or a reviewer note; not a syntactic rule
A curated set being complete (subnets, attributes)a unit test next to the data
One class / one sitea regression test, not a rule

Do not force a taint problem into a syntactic rule: if safe and unsafe look identical at the sink and differ only by where a value came from, the rule is all false positives.

The shape (copy, do not reinvent)

Model the new rule on the existing .github/sa-tools/rules/*Rule.php: global namespace, Symfony license header, implements Rule with getNodeType()/processNode(), a stable identifier('symfony.<camelCase>'), and the narrowest node type that sees the shape.

Show full SKILL.md (322 more words)Show less

The traps

  1. Registration is one line plus the file. Drop <Name>Rule.php into .github/sa-tools/rules/ and add its class to the rules: list in .github/sa-tools/rules.neon (which phpstan.dist.neon includes). The folder's autoloader (rules/bootstrap.php, wired once via --autoload-file in static-analysis.yml) and the .gitignore folder whitelist (!rules, !rules/*) pick the file up with no further edits. A rule that needs constructor arguments takes a services: entry tagged phpstan.rules.rule in that same rules.neon instead of the rules: shorthand. (PHPStan only autoloads a project-local rule class early enough via --autoload-file or composer PSR-4 — a neon scanDirectories/bootstrapFiles runs too late — hence the stable bootstrap, which you never touch per rule.)
  2. phpstan analyse counts are nondeterministic (result cache + parallel workers report 0 then N for the same input). Verify the logic with PHPStan\Testing\RuleTestCase in a throwaway composer require phpstan/phpstan phpunit/phpunit project, with fixtures for the unsafe shape (must fire), the fixed shape (silent), and the nearest safe look-alike from the decision boundary (silent). Never gate on a local analyse count.
  3. The diff-lint only flags new errors. phpstan-diff.php compares the PR against the base branch and fails only on errors new to the PR, so standing violations are absorbed. Design target: zero findings on the current tree at introduction (no baseline entry).

Convention path

If the invariant is "this boundary class must ship its regression test", extend check-hardening-tests.php (pure tokenizer, no autoload) instead of writing a rule. Add the boundary predicate and the required-test predicate in its existing style; accepted gaps go in the ALLOWLIST const as a TODO with a reason, never a permanent waiver.

Error handling

  • If the invariant needs data-flow, do not ship a syntactic rule that fakes it. Say it is a taint or checklist item and wait for confirmation on the fallback.
  • Do not edit phpstan-diff.php or the workflow to make a rule pass. Fix the rule.
  • House conventions: Symfony license header, no em-dashes, no Claude/Anthropic credit, comments sparingly, no issue numbers in code.

© symfony, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/hardening-rule of symfony/symfony.

Open the folder on GitHubat commit af79aa7

Compare with similar skills

Hardening Rule next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hardening Rule compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hardening Rule this skillsymfony/symfony31k—~1.2kAutomated safety check: PassMIT
Add Changeloggambitph/Stackable351—~1.5kAutomated safety check: PassGPL-3.0
Clean Architecturegiuseppe-trisciuoglio/developer-kit357—~4.2kAutomated safety check: NotesMIT
B24phpsdk Maintainerbitrix24/b24phpsdk102—~10kAutomated safety check: NotesMIT
PHP ProJeffallan/claude-skills12k—~1.6kAutomated safety check: NotesMIT
Shopware CLIshopware/shopware-cli124—~4.9kAutomated safety check: PassMIT

Similar skills

  • Add Changelog

    gambitph/Stackable

    Adds or updates a WordPress plugin changelog entry in readme.txt from the project's Release Roadmap for a confirmed plugin version.

    351 GitHub stars~1.5k tokensUpdated 4 days ago
    DevelopmentAuto-check passed

  • Clean Architecture

    giuseppe-trisciuoglio/developer-kit

    Provides implementation patterns for Clean Architecture, Hexagonal Architecture (Ports & Adapters), and Domain-Driven Design in PHP 8.3+ with Symfony 7.x.

    357 GitHub stars~4.2k tokensUpdated 1 mo ago
    DevelopmentAuto-check: notes

  • B24phpsdk Maintainer

    bitrix24/b24phpsdk

    A skill your agent uses whenever working with GitHub issues in the bitrix24/b24phpsdk repository: creating new issues, reading existing ones, planning implementation from an issue, referencing an…

    102 GitHub stars~10k tokensUpdated 11 days ago
    Backend & APIsAuto-check: notes

  • PHP Pro

    Jeffallan/claude-skills

    Writes strictly typed modern PHP 8.3+ for Laravel, Symfony and plain projects, with PHPStan level 9, PHPUnit or Pest tests, typed DTOs and secure defaults.

    12k GitHub stars~1.6k tokensUpdated 7 days ago
    Backend & APIsAuto-check: notes

  • Shopware CLI

    shopware/shopware-cli

    Use Shopware CLI for Shopware project, extension, and account workflows — create and install new projects (project create, project dev install), validate projects or extensions (with…

    124 GitHub stars~4.9k tokensUpdated 3 days ago
    Testing & QAAuto-check passed

  • Shopware CLI Docker

    shopware/shopware-cli

    A skill your agent uses when working on Docker-backed Shopware projects and needing to run Shopware or Symfony CLI commands, interact with project services or databases, start or stop the…

    124 GitHub stars~1.8k tokensUpdated 3 days ago
    DevOps & CloudAuto-check passed

More from symfony/symfony

All 9 skills in this repo

  • Sync Translations

    symfony/symfony

    Synchronize translation catalogs across maintained Symfony branches: find messages that newer branches added to the English catalogs but that are still missing from the oldest maintained branch…

    31k GitHub stars~1.9k tokensUpdated today
    Auto-check passed

  • Bug Triage

    symfony/symfony

    Decide whether open Bug PRs target the correct branch. An agent skill from symfony/symfony.

    31k GitHub stars~1.9k tokensUpdated today
    Auto-check passed

  • Merge Up

    symfony/symfony

    Cascade-merge maintained Symfony branches from oldest to newest (e.g.

    31k GitHub stars~4k tokensUpdated today
    Auto-check passed

  • PR Merge

    symfony/symfony

    Merge a reviewed pull request the way the Symfony core team does: one --no-ff merge commit per PR, whose message archives the whole discussion, with the review gates checked first.

    31k GitHub stars~3.1k tokensUpdated today
    Auto-check passed

  • Security Triage

    symfony/symfony

    Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter).

    31k GitHub stars~2.6k tokensUpdated today
    Auto-check passed

  • Symfony Security Review

    symfony/symfony

    Review a change (a PR, the current branch diff, or a set of files) or audit a component or the whole tree for missing or incorrect security hardening.

    31k GitHub stars~2.9k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Hardening Rule

What does Hardening Rule do?

Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps. Hardening Rule is an agent skill from symfony/symfony. Decide whether a recurring hardening invariant is worth a CI gate, and add it without hitting the traps.

When should I use Hardening Rule?

Hardening Rule fits situations like: the user says write a PHPStan rule; add a hardening rule; gate this pattern; catch this in CI.

How do I install Hardening Rule in Claude Code?

Run `npx skills add symfony/symfony --skill hardening-rule -a claude-code`. Or copy the skill folder (.agents/skills/hardening-rule in symfony/symfony) into .claude/skills/hardening-rule in your project. Claude Code loads it when a task matches its description.

How do I install Hardening Rule in Codex?

Run `npx skills add symfony/symfony --skill hardening-rule -a codex`. Or copy the skill folder (.agents/skills/hardening-rule in symfony/symfony) into .agents/skills/hardening-rule in your project. Codex loads it when a task matches its description.

Can I use Hardening Rule in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add symfony/symfony --skill hardening-rule -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hardening-rule, .gemini/skills/hardening-rule, .github/skills/hardening-rule and .opencode/skills/hardening-rule in your project.

What does Hardening Rule need to run?

Going by SKILL.md and its folder, Hardening Rule needs the command-line tools its instructions call (composer).

Does Hardening Rule access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Hardening Rule safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Hardening Rule use?

Hardening Rule is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hardening Rule use?

About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Hardening Rule?

Skills that share tags, products or a category with Hardening Rule: Add Changelog (gambitph/Stackable, 351 stars), Clean Architecture (giuseppe-trisciuoglio/developer-kit, 357 stars), B24phpsdk Maintainer (bitrix24/b24phpsdk, 102 stars) and PHP Pro (Jeffallan/claude-skills, 12k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hardening Rule?

symfony (a GitHub organization) maintains it in symfony/symfony, which has 31,184 GitHub stars. The repository holds 9 skills in this directory. The repository was last updated on October 10, 2026.

Source: symfony/symfony on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.