Agent skill · security · alirezarezvani
security-guidance
Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserialization, eval or GitHub Actions injection. Warns once per file and rule; ENABLE_SECURITY_REMINDER=0 turns it off.
Why this skill is useful
Adds a PreToolUse hook that blocks 12 specific security anti-patterns, enhancing the AI's ability to prevent security vulnerabilities in code.
What it needs
About 4k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Security Guidance Hook A PreToolUse hook that blocks 12 common security anti-patterns before Claude Code writes them. This skill is a hook, not a slash command. Once installed, it runs automatically before every Edit, Write, or MultiEdit operation and warns + blocks if it detects a known dangerous pattern. What It Catches The hook scans both: The file path being edited — flags GitHub Actions workflow files with risky ${{ }} patterns The content being written — substring matches against 11 anti-patterns Pattern Category Risk --- --- --- GitHub Actions workflow expressions Path-based Workflow command injection via untrusted inputs childprocess.exec, exec(, execSync( Substring Node.js command injection new Function Substring JS code injection eval( Substring JS code injection dangerouslySetInnerHTML Substring React XSS document.write Substring DOM XSS .innerHTML = Substring DOM XSS pickle Substring Python deserialization RCE os.system, from os import system Substring Python command injection shell=True (subprocess) Substring Python command injection f-string SQL or .format SQL Substring SQL injection yaml.load(, yaml.unsafeload Substring YAML deserialization RCE How It Works 1. Claude Code is about to run Edit, Write, or MultiEdit 2. PreToolUse hook fires → invokes securityreminderhook.py with the tool input as JSON on stdin 3. The hook extracts filepath + content + checks against the pattern table 4. If a pattern matches AND this warning hasn't been shown for this file+rule in this session: Print the warning to stderr (Claude sees it) Exit code 2 → blocks the tool call Save the warning key to ~/.claude/securitywarningsstate<session>.json 5. If a pattern matches BUT the warning was already shown this session: Allow the tool call (exit code 0) — Claude already saw the warning once 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/security-guidance--7d5809