Name: security-guidance
Rating: 70.39999999999999 (1 reviews)
Author: alirezarezvani

security-guidance

PreToolUse security-anti-pattern hook for Claude Code. Catches 12 common security risks (command injection, XSS, SQL injection, unsafe deserialization, GitHub Actions workflow injection, eval/new Function code injection) BEFORE the Edit/Write/MultiEdit operation completes. Session-state caching prevents duplicate warnings on the same file+rule combo. Stdlib only — no dependencies. Use when you want a safety net during Claude Code sessions that touch security-sensitive code (auth, payments, user input handling, IaC). Disable with ENABLE_SECURITY_REMINDER=0 if you need to perform a verified-safe operation that would otherwise trip a pattern. Triggers — "add security hook", "block unsafe code", "detect command injection before write", "prevent SQL injection patterns", "security warning hook".

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is security-guidance in alirezarezvani/claude-skills

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, mostly lean hook skill with executable install/config guidance and a clearly sequenced runtime workflow. Scores are uniformly strong (4s) rather than perfect: minor conciseness trims are possible, the hook script isn't shown inline, and the single-file structure is slightly longer than the simple-skill threshold.

Suggestions

Move the bare version number (2.7.3) into a dedicated version/deprecation note or drop it, since time-sensitive metadata outside such a section lightly penalizes conciseness.

Inline a minimal excerpt of security_reminder_hook.py (or a clearly signaled link to it) so the core behavior is actionable from the body alone, not just referenced by filename.

Consider splitting the 12-row pattern table into a short reference file linked from "What It Catches" to shorten the main body and strengthen progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes Claude's competence; skill-specific trade-off rationale ("Why The Patterns Are Substring-Based") earns its place rather than restating known concepts, though the Related Skills list, detailed modifications log, and a bare version number (2.7.3) could be trimmed.	4 / 5
Actionability	Installation (two `/plugin` commands), the disable env var, and the per-file override comment pattern are all executable and copy-paste ready; the only gap is that the core hook script itself is referenced by name but not shown inline.	4 / 5
Workflow Clarity	The "How It Works" section lays out a clear six-step sequence with explicit decision checkpoints (exit code 2 to block vs 0 to allow, cache-hit bypass), and the Debug Log section supports error recovery; it falls short of 5 because the checkpoints are descriptive of hook behavior rather than a validate-fix-retry feedback loop the reader executes.	4 / 5
Progressive Disclosure	No bundle files exist, so the skill is a single self-contained file organized with clear section headers (What It Catches, How It Works, Installation, Configuration, etc.) and no nested references; it is over 50 lines and the pattern table could arguably live in a reference file, so it does not fully meet the simple-skill exception for a 5.	4 / 5
	Total	16 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that clearly states what the skill does and when to use it, with a rich set of natural trigger phrases and a distinct niche. The only weakness is second-person voice ("you want"), which costs it one specificity point per the rubric's voice guideline.

Dimension	Reasoning	Score
Specificity	Names the domain and multiple concrete actions ("Catches 12 common security risks", "blocks... before the Edit/Write/MultiEdit operation completes", "Session-state caching prevents duplicate warnings"), which approaches comprehensive coverage; reduced from 5 because the description uses second person ("Use when you want a safety net"), which the rubric penalizes by one point on specificity.	4 / 5
Completeness	It explicitly answers both what (a PreToolUse hook catching 12 named security anti-patterns and blocking edits) and when ("Use when you want a safety net during Claude Code sessions that touch security-sensitive code"), with concrete trigger phrases attached.	5 / 5
Trigger Term Quality	An explicit "Triggers" block lists five natural phrases ("add security hook", "block unsafe code", "detect command injection before write", "prevent SQL injection patterns", "security warning hook") plus domain keywords (auth, payments, user input handling, IaC), giving comprehensive coverage of terms a user would actually say.	5 / 5
Distinctiveness Conflict Risk	It occupies a clear niche (a PreToolUse Claude Code hook that blocks writes) with distinct, specific triggers, making conflict with unrelated skills unlikely.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: alirezarezvani/claude-skills
Path: .gemini/skills/security-guidance/SKILL.md
Commit: 19392f7

Reviewed: ~7 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.