magento-hyva — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited magento-hyva (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Hyvä is a Magento frontend theme that replaces the Luma stack (RequireJS + Knockout + jQuery + LESS) with Alpine.js + Tailwind CSS, plus Magewire for reactive server-rendered components. It ships far less JavaScript and is the de-facto modern choice for new Magento and Mage-OS storefronts. Layout XML, view models, and the module system are unchanged — only the template/JS/CSS layer differs.
Hyvä's core theme is commercial (a one-time license, package hyva-themes/magento2-default-theme); the supporting Hyva_Theme module and many helpers are MIT. This skill covers the development conventions; it does not bundle or require the licensed theme.
| Task | Read first |
|---|---|
| New child theme, Tailwind build setup | references/theme-setup.md |
| Interactivity in templates (Alpine.js) | references/alpine.md |
| Styling, Tailwind config, design tokens | references/tailwind.md |
| Reactive server-driven components (forms, cart) | references/magewire.md |
| Override a template, add a block, layout XML | references/overriding.md |
| A Luma module/extension breaks on Hyvä | references/luma-compat.md |
files and the web/tailwind/ build directory deterministically:
python scripts/scaffold-theme.py "Vendor/theme-name" --parent Hyva/defaultlogic belongs on the server. Keep JavaScript minimal — that is the entire point of Hyvä.
web/tailwind/tailwind-source.css →web/css/styles.css:
cd app/design/frontend/Vendor/theme/web/tailwind && npm ci && npm run build
bin/magento cache:flush
# production: bin/magento setup:static-content:deploy -fdata-mage-init, require([...]),or $(...), you're writing Luma, not Hyvä. Use Alpine (x-data, @click, x-model) for client interactivity, Magewire for server interactivity.
the Tailwind layer via @apply only when a utility string genuinely repeats.
$escaper->escapeHtml() / escapeHtmlAttr() /escapeUrl(). Alpine expressions in attributes are still attribute values: escape the PHP-injected parts.
restrict mode; inline event handlers and scripts must go through the secure renderer / Hyvä's CSP-friendly patterns (references/alpine.md).
(see the magento-module frontend.md reference).
A running Hyvä theme requires the licensed hyva-themes/magento2-default-theme package. When it isn't installed, verify generated code structurally: theme registration and theme.xml parent resolve, tailwind.config.js/package.json are valid, layout XML validates, and templates escape output. Note in your summary that a live render needs a Hyvä-licensed environment.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.