security-guidance

PreToolUse security-anti-pattern hook for Claude Code. Catches 12 common security risks (command injection, XSS, SQL injection, unsafe deserialization, GitHub Actions workflow injection, eval/new Function code injection) BEFORE the Edit/Write/MultiEdit operation completes. Session-state caching prevents duplicate warnings on the same file+rule combo. Stdlib only — no dependencies. Use when you want a safety net during Claude Code sessions that touch security-sensitive code (auth, payments, user input handling, IaC). Disable with ENABLE_SECURITY_REMINDER=0 if you need to perform a verified-safe operation that would otherwise trip a pattern. Triggers — "add security hook", "block unsafe code", "detect command injection before write", "prevent SQL injection patterns", "security warning hook".

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and well-sequenced with concrete commands and a clear runtime decision tree, and it avoids padding with basic concepts. Its main weakness is progressive disclosure: a high-quality reference file exists but is not linked, and some rationale content could be moved out of SKILL.md.

Suggestions

Link references/pretooluse_hook_canon.md from the body (e.g., a "Design rationale" pointer) so the existing one-level-deep reference is discoverable.

Move the "Why The Patterns Are Substring-Based" rationale and/or the "Anti-Patterns" section into the reference file to slim SKILL.md toward an overview.

Tighten editorial commentary (e.g., "Use sparingly — the hook is most useful exactly when you're tempted to disable it") to reduce tokens that don't add executable guidance.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and free of concepts Claude already knows (no XSS/SQL primers), but editorial sections like "Why The Patterns Are Substring-Based" and the "Use sparingly..." commentary are minor over-explanation that could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready install commands, env-var usage, a debug tail command, and a complete per-file override code example with a real comment annotation — fully executable guidance for install, config, and override.	5 / 5
Workflow Clarity	The "How It Works" section is a clear 6-step decision tree with explicit branches and exit codes, plus a documented debug-log recovery path; minor gap is that error-recovery from hook misfires is described separately rather than as an integrated checkpoint.	4 / 5
Progressive Disclosure	Sections are well-organized, but the existing reference file references/pretooluse_hook_canon.md is never linked from the body, and separable content (substring-vs-AST rationale, anti-patterns) is inlined rather than split out.	3 / 5
	Total	16 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and trigger-rich, clearly stating both the capability and the use conditions with natural phrasing a user would say. Its only slight weakness is that the broad security domain creates minor overlap with adjacent security skills.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete actions — "Catches 12 common security risks (command injection, XSS, SQL injection, unsafe deserialization...)" plus session-state caching and pre-operation blocking — matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly states both what it does (PreToolUse anti-pattern hook catching 12 risk classes) and when to use it ("Use when you want a safety net during Claude Code sessions that touch security-sensitive code (auth, payments, user input handling, IaC)") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Provides a broad set of natural trigger phrases ("add security hook", "block unsafe code", "detect command injection before write", "prevent SQL injection patterns") plus a "Use when..." clause, giving comprehensive natural-term coverage.	5 / 5
Distinctiveness Conflict Risk	The PreToolUse-write-hook niche is distinct with specific triggers, but the broad security domain shares some overlap with related red-team/threat-detection skills, keeping it just below the minimal-conflict anchor.	4 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: alirezarezvani/claude-skills
Path: engineering/security-guidance/skills/security-guidance/SKILL.md
Commit: 19392f7

Reviewed: ~6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.