Security Guidance (claude-skills)

Security Guidance (claude-skills) is a community plugin from Alireza Rezvani's claude-skills collection. It's a hook for Claude Code: before Claude edits or writes a file, it checks the change against a list of known-dangerous patterns, and when one matches it shows Claude a warning and blocks that edit. It's ported from David Dworken's MIT-licensed hook, with three patterns added. It isn't Anthropic's own Security Guidance plugin. What it catches - Command injection: child_process.exec, exec( and execSync(, os.system, and subprocess with shell=True - Code injection: eval( and new Function - XSS: dangerouslySetInnerHTML, document.write and .innerHTML = - Unsafe deserialization: pickle, yaml.load( and yaml.unsafe_load - SQL injection: SELECT, INSERT, UPDATE or DELETE queries built with f-strings or .format( - GitHub Actions workflow files, where untrusted ${{ }} inputs can inject commands How it works - It runs before every Edit, Write or MultiEdit, with no setup. It needs only Python 3, with no other dependencies. - A match blocks the edit and tells Claude why. The same warning for the same file isn't repeated in that session, so Claude can go ahead once it has seen it. - For a deliberate use (say, pickle in an internal tool), the author suggests a comment in the file explaining why it's safe. How to install it In Claude Code, run /plugin marketplace add alirezarezvani/claude-skills, then /plugin install security-guidance@claude-code-skills. Good to know - It's a community plugin, not Anthropic's. - The checks are plain text matches, so expect some false positives. For stricter checks, the author suggests adding a SAST tool such as Semgrep or CodeQL to CI. - Turn it off for one session with ENABLE_SECURITY_REMINDER=0. - It keeps per-session state and a debug log in ~/.claude/.

• “Add a security hook that blocks unsafe code before it's written.”

  Copy

• “Detect command injection before you write the file.”

  Copy

• “Prevent SQL injection patterns in this project.”

  Copy

• “Warn me whenever code uses eval, pickle or os.system.”

  Copy

• “Add a GitHub Actions security hook.”

  Copy