Symfony 安全审计
Symfony 安全审计 是 AI Skill Hub 本期精选Agent工作流之一。综合评分 8.0 分，整体质量较高。我们强烈推荐将其纳入你的 AI 工具库，帮助提升工作效率。
📚 深度解析
Symfony 安全审计 工作流的设计遵循"最小配置，最大复用"原则：核心逻辑已经封装好，用户只需配置自己的 API Key 和业务参数即可快速上手。工作流内置错误处理和重试机制，在网络波动或 API 限速等情况下仍能稳定运行，适合作为生产环境的自动化基础设施。
在实际部署时，建议先在测试环境中运行 3-5 次，验证各个环节的输出结果符合预期，再部署到生产环境。AI Skill Hub 评分 8.0 分，是同类 Agent 工作流中的精选推荐。
📋 工具概览
Symfony 安全审计 是一套完整的 AI Agent 自动化工作流方案。通过可视化的节点编排，将复杂的多步骤任务拆解为清晰的自动化流程，实现全程无人值守的智能处理。支持与数百种外部服务和 API 无缝集成，适合构建数据处理管线、业务自动化和 AI 辅助决策系统。
📖 中文文档
Symfony 安全审计 是一套完整的 AI Agent 自动化工作流方案。通过可视化的节点编排，将复杂的多步骤任务拆解为清晰的自动化流程，实现全程无人值守的智能处理。支持与数百种外部服务和 API 无缝集成，适合构建数据处理管线、业务自动化和 AI 辅助决策系统。
- 可视化 Agent 工作流编排，无需编写复杂代码
- 支持多步骤自动化任务链，实现全流程无人值守
- 与外部 API、数据库和第三方服务无缝集成
- 内置错误处理与自动重试机制，保障稳定运行
- 提供可复用的自动化模板，快速在同类场景部署
- 自动化日常重复性工作，将精力集中于创造性任务
- 构建数据采集 → 处理 → 输出的完整自动化管线
- 实现跨平台、跨系统的数据流转和业务协同
# 克隆仓库 git clone https://github.com/vinceAmstoutz/symfony-security-auditor cd symfony-security-auditor # 查看安装说明 cat README.md # 按 README 完成环境依赖安装后即可使用
- 访问 GitHub 仓库获取工作流文件
- 在对应平台（Dify / Flowise / Make 等）中找到「导入工作流」功能
- 上传工作流文件
- 按照提示配置必要的环境变量和 API Key
- 运行测试确认流程正常后投入使用
# 查看帮助 symfony-security-auditor --help # 基本运行 symfony-security-auditor [options] <input> # 详细使用说明请查阅文档 # https://github.com/vinceAmstoutz/symfony-security-auditor
# symfony-security-auditor 配置说明 # 查看配置选项 symfony-security-auditor --config-example > config.yml # 常见配置项 # output_dir: ./output # log_level: info # workers: 4 # 环境变量（覆盖配置文件） export SYMFONY_SECURITY_AUDITOR_CONFIG="/path/to/config.yml"
Symfony Security Auditor
AI-powered, multi-agent security auditor for Symfony applications. An adversarial Attacker ⚔ Reviewer loop catches the application-level flaws SAST tools miss. Provider-agnostic via symfony/ai.
Features
- Multi-agent loop — adversarial Attacker + skeptical Reviewer cut false positives across up to 3 iterations, with confirmed findings fed back so later iterations generalize patterns instead of re-finding the same bugs. - 39 vulnerability types covering OWASP-aligned categories: Injection, Broken Access Control, Logic Flaws, Symfony-specific, Data Exposure, Cryptographic — including the modern Symfony 7.x/8.x surface (Authenticators, Messenger handlers, Webhooks, Serializer denormalizers, Schedules, RateLimiter, Mailer, cache poisoning). - Symfony-aware — understands Controllers, Voters, Forms, Firewalls, Routes, #[IsGranted], denyAccessUnlessGranted, #[MapRequestPayload], Twig/Live Components, and surfaces controllers without proper access checks. - Feature-based chunking — groups a controller with its entity, repository, form, voter, and templates so the Attacker can follow data flow across files. - Deterministic pre-scan — a zero-token risk-marker pass flags concrete locations (unserialize, |raw, hardcoded secrets, unsafe Doctrine, …) to focus the LLM; optional lean mode drops marker-free files to cut tokens. - Diff mode — audit:run --since=main audits only changed files for fast pull-request CI. - Cross-file investigation tools — Attacker (and optionally Reviewer) can read_file, grep, list_files, and lookup_advisory (zero-config live CVE lookups via composer audit, backed by Packagist + GitHub Security Advisories). - One-knob profiles — fast, balanced, and thorough preset the cost/speed/depth levers in a single line; any explicit key still wins. - Tunable for speed & cost — split-model (powerful Attacker + cheap Reviewer, ~20× cheaper), concurrent Attacker and Reviewer calls (attacker_max_concurrent / reviewer_max_concurrent), Anthropic prompt caching on by default (~90% input-token discount), content-hash caching that skips identical chunks, cheap→expensive escalation, and code slicing. - Secret-safe by default — credential-shaped strings are scrubbed from file content before it reaches the LLM (see Security by design). - Rate-limit aware — reactive retry with Retry-After-aware exponential backoff plus an optional proactive token-bucket limiter keep you inside provider quotas (see Cost & Performance). - PoC synthesis — optionally attach a concrete, copy-pasteable reproduction (curl/console/payload) to every high-severity finding. - Five output formats — console, json, sarif (GitHub Code Scanning / GitLab Security Dashboard), html (self-contained, shareable), and markdown (PR-friendly). Baseline suppression: --generate-baseline accepts known findings, --baseline drops them from the report and exit code so only new findings fail CI. - CI-ready — a reusable GitHub Action (uses: vinceamstoutz/symfony-security-auditor@1.12.0) plus GitLab CI templates, with SARIF upload to Code Scanning. See CI Integration. - DDD architecture — strict layering and a sole LLMClientInterface seam let you plug in custom providers, agents, stages, advisory feeds, or report formats.
Getting Started
1. Install — Symfony Flex wires everything
composer require --dev vinceamstoutz/symfony-security-auditorThe official Flex recipe registers the bundle (dev/test) and drops a pre-configured config/packages/symfony_security_auditor.yaml.
Not using Flex? See Manual setup.
2. Install a platform bridge
```bash
3. Configure the platform
```yaml
config/packages/ai.yaml (or e.g. config/packages/ai_anthropic_platform.yaml)
ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' ```
4. Adjust the auditor config
The Flex recipe already created this file — pick your model:
```yaml
config/packages/symfony_security_auditor.yaml
symfony_security_auditor: model: 'claude-opus-4-8'
Optionally pick a one-knob preset — `fast`, `balanced` (default), or `thorough`:
config/packages/symfony_security_auditor.yaml
symfony_security_auditor: profile: 'fast' ```
A profile only fills the keys you leave unset — any explicitly configured key always wins. See Cost & Performance for exactly what each profile sets.
FAQ
How much does an audit cost? Depends on project size and model. A medium Symfony app (~150 files) on Claude Opus + Haiku split-model with prompt caching enabled costs roughly $0.50 per nightly run. See CI → Managing LLM Costs.
Does it send my code to the cloud? Only to the LLM provider you configure, and credential-shaped strings are scrubbed first (see Security by design). For zero-cloud operation, use the Ollama local platform.
Full FAQ — privacy, false positives, model picks, comparisons: docs/faq.md.
高质量的自动化安全审计工具
⚡ 核心功能
- 可视化 Agent 工作流编排，无需编写复杂代码
- 支持多步骤自动化任务链，实现全流程无人值守
- 与外部 API、数据库和第三方服务无缝集成
- 内置错误处理与自动重试机制，保障稳定运行
- 提供可复用的自动化模板，快速在同类场景部署
👥 适合人群
🎯 使用场景
- 自动化日常重复性工作，将精力集中于创造性任务
- 构建数据采集 → 处理 → 输出的完整自动化管线
- 实现跨平台、跨系统的数据流转和业务协同
⚖️ 优点与不足
- +MIT 协议，可免费商用
- +大幅减少重复性人工操作
- +可视化流程，清晰直观
- +可扩展性强，支持复杂场景
- −初始配置和调试需投入一定时间
- −强依赖外部服务的稳定性
- −复杂场景需具备一定技术基础
AI Skill Hub 为第三方内容聚合平台，本页面信息基于公开数据整理，不对工具功能和质量作任何法律背书。
建议在沙箱或测试环境中充分验证后，再部署至生产环境，并做好必要的安全评估。
✅ MIT 协议 — 最宽松的开源协议之一，可自由商用、修改、分发，仅需保留版权声明。
🔗 相关工具推荐
❓ 常见问题 FAQ
经综合评估，Symfony 安全审计 在Agent工作流赛道中表现稳健，质量优秀。如果你已有明确的使用需求，可以直接上手体验；如果还在评估阶段，建议对比同类工具后再做决策。
| 原始名称 | symfony-security-auditor |
| 原始描述 | 开源AI工作流：AI-powered multi-agent security auditor for Symfony applications — provider-agno。⭐58 · PHP |
| Topics | AI安全Symfony多代理 |
| GitHub | https://github.com/vinceAmstoutz/symfony-security-auditor |
| License | MIT |
| 语言 | PHP |
收录时间：2026-06-24 · 更新时间：2026-06-24 · License：MIT · AI Skill Hub 不对第三方内容的准确性作法律背书。