Agent skill · security · affaan-m
perl-security
Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.
Why this skill is useful
Provides specific security patterns and practices for Perl applications that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Perl Security Patterns Comprehensive security guidelines for Perl applications covering input validation, injection prevention, and secure coding practices. When to Activate Handling user input in Perl applications Building Perl web applications (CGI, Mojolicious, Dancer2, Catalyst) Reviewing Perl code for security vulnerabilities Performing file operations with user-supplied paths Executing system commands from Perl Writing DBI database queries How It Works Start with taint-aware input boundaries, then move outward: validate and untaint inputs, keep filesystem and process execution constrained, and use parameterized DBI queries everywhere. The examples below show the safe defaults this skill expects you to apply before shipping Perl code that touches user input, the shell, or the network. Taint Mode Perl's taint mode (-T) tracks data from external sources and prevents it from being used in unsafe operations without explicit validation. Enabling Taint Mode Untainting Pattern Input Validation Allowlist Over Blocklist Length Constraints Safe Regular Expressions ReDoS Prevention Catastrophic backtracking occurs with nested quantifiers on overlapping patterns. Safe File Operations Three-Argument Open TOCTOU Prevention and Path Traversal Use File::Temp for temporary files (tempfile(UNLINK => 1)) and flock(LOCKEX) to prevent race conditions. Safe Process Execution List-Form system and exec Also use Capture::Tiny for capturing stdout/stderr from external commands safely. SQL Injection Prevention DBI Placeholders Dynamic Column Allowlists DBIx::Class (ORM Safety) Web Security XSS Prevention CSRF Protection Use constant-time comparison when verifying tokens. Most web frameworks (Mojolicious, Dancer2, Catalyst) provide built-in CSRF protection — prefer those over hand-rolled solutions. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/perl-security--aee15c