security-guidance
Installs and tunes a PreToolUse hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserialization, eval or GitHub Actions injection, once per file and rule.
- Kind
- Skill
- Works with
- Claude Code
- Languages
- SQL
- Source
- Claude Skills (Alireza Rezvani) @ e4a1dc369590
- Path
- engineering/security-guidance/skills/security-guidance/SKILL.md
- Jobs
- Guardrails
- Topics
- Security audits
Credit
- Made by
- alirezarezvani
- Original
- github.com/alirezarezvani/claude-skills/blob/e4a1dc3695908dd5…
- License
- MIT
Listed by Skill Manifest; not made by us.
InstallInstall it from a plugin marketplace.
/plugin marketplace add alirezarezvani/claude-skills
Install factsScanned 2 Nov 2026
- Adds
- .claude/skills/security-guidance/ (the skill folder)
- 1 file(s) the skill refers to
- Runs scripts
- Yes
- shell block in the text
- Uses the network
- None found
- Needs secrets
- None found
- Source revision
- e4a1dc369590
- Licence
- MIT
- Last activity
- 31 Oct 2026
- Review
- Reviewed
Found by a static scan of the stored text; nothing is run. “None found” is not a guarantee, so read what you install before you run it.
- Only the main file is read; other files in the folder are not scanned
# Security Guidance Hook
**A PreToolUse hook that blocks 12 common security anti-patterns before Claude Code writes them.**
This skill is a **hook**, not a slash command. Once installed, it runs automatically before every `Edit`, `Write`, or `MultiEdit` operation and warns + blocks if it detects a known dangerous pattern.
## What It Catches
The hook scans both:
- **The file path being edited** — flags GitHub Actions workflow files with risky `${{ }}` patterns
- **The content being written** — substring matches against 11 anti-patterns
| Pattern | Category | Risk |
|---|---|---|
| GitHub Actions workflow expressions | Path-based | Workflow command injection via untrusted inputs |
| `child_process.exec`, `exec(`, `execSync(` | Substring | Node.js command injection |
| `new Function` | Substring | JS code injection |
| `eval(` | Substring | JS code injection |
| `dangerouslySetInnerHTML` | Substring | React XSS |
| `document.write` | Substring | DOM XSS |
| `.innerHTML =` | Substring | DOM XSS |
| `pickle` | Substring | Python deserialization RCE |
| `os.system`, `from os import system` | Substring | Python command injection |
…