From magento2-commerce
Implements Magento 2 security: CSP config, 2FA, CSRF protection, ACL/admin security, input validation/output escaping, reCAPTCHA. For hardening installs or posture reviews.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin magento2-commerceThis skill is limited to using the following tools:
**Fetch live docs**:
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Fetch live docs:
site:experienceleague.adobe.com commerce security for security best practicessite:developer.adobe.com commerce php development security for developer security guidemagento 2 security patches latest for recent security updatesProtects against XSS and code injection by restricting which resources (scripts, styles, images, fonts) can load.
etc/csp_whitelist.xml — whitelist external domains per CSP directivescript-src, style-src, img-src, font-src, connect-src, frame-srcWhitelist third-party domains for payment gateways, analytics, CDNs:
csp_whitelist.xml under the appropriate directivereport-only mode first to identify missing whitelistsform_key — 16-character token included in all admin formsAvailable at Stores > Settings > Configuration > Advanced > Admin > Security:
/admin path)In PHTML templates, always escape output:
$escaper->escapeHtml($value) — HTML context$escaper->escapeUrl($url) — URL context$escaper->escapeJs($value) — JavaScript context$escaper->escapeHtmlAttr($value) — HTML attribute context$escaper->escapeCss($value) — CSS contextecho $value directly in templates/admin)Fetch the security documentation for current CSP directives, 2FA configuration options, and latest security patches before implementing.