create-admin-routing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-admin-routing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
src/PrestaShopBundle/Resources/config/routing/admin/{domain}.yml._legacy_controller (permanent — see below). While the page is under migration, also include _legacy_feature_flag so requests are dispatched to the new or legacy controller depending on the flag state: admin_{domain}s_index:
path: /{domain}s
methods: [GET]
defaults:
_controller: 'PrestaShopBundle:Admin/{Section}/{Domain}:index'
_legacy_controller: Admin{Domain}s
_legacy_feature_flag: {domain}{id} parameter), delete (POST with {id}), toggle status (POST+JSON), bulk delete/enable/disable (POST)._legacy_feature_flag value must exactly match the name of the feature flag in feature_flag.xml.php bin/console debug:router | grep {domain}._legacy_controller is permanentKeep _legacy_controller on every route — it stays for the lifetime of the page, even after full migration. Two consumers depend on it:
is_granted('read', request.get('_legacy_controller')) rely on this attribute being presentLink::getAdminLink('Admin{Domain}s'); the routing layer uses _legacy_controller to resolve those calls to the Symfony routeRemoving _legacy_controller after release would silently break permissions and any legacy Link::getAdminLink() callers — never strip it.
_legacy_feature_flag is migration-only_legacy_feature_flag, in contrast, only exists while the new page coexists with the legacy one. Once the feature flag has been promoted to stable (GA) and the legacy controller is no longer used as a fallback, remove `_legacy_feature_flag` from the route — but keep _legacy_controller. Routes for fully-released pages have _legacy_controller and no _legacy_feature_flag.
This skill scaffolds routes for pages currently under migration. For routes added or refactored on already-released pages, omit _legacy_feature_flag and keep _legacy_controller.
Conventions (atomic commit, case-sensitive flag matching, toggle returning JSON, _legacy_controller permanence, post-release flag removal) are in Controller/CONTEXT.md. Skill-specific reminders:
{id} path parameter_legacy_controller — it remains required for permissions and legacy link conversion long after migration is over~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.