# Security Guidance (claude-skills)

> Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.

Security Guidance (claude-skills) is a community plugin from Alireza Rezvani's claude-skills collection. It's a hook for Claude Code: before Claude edits or writes a file, it checks the change against a list of known-dangerous patterns, and when one matches it shows Claude a warning and blocks that edit. It's ported from David Dworken's MIT-licensed hook, with three patterns added. It isn't Anthropic's own Security Guidance plugin.

What it catches
- Command injection: child_process.exec, exec( and execSync(, os.system, and subprocess with shell=True
- Code injection: eval( and new Function
- XSS: dangerouslySetInnerHTML, document.write and .innerHTML =
- Unsafe deserialization: pickle, yaml.load( and yaml.unsafe_load
- SQL injection: SELECT, INSERT, UPDATE or DELETE queries built with f-strings or .format(
- GitHub Actions workflow files, where untrusted ${{ }} inputs can inject commands

How it works
- It runs before every Edit, Write or MultiEdit, with no setup. It needs only Python 3, with no other dependencies.
- A match blocks the edit and tells Claude why. The same warning for the same file isn't repeated in that session, so Claude can go ahead once it has seen it.
- For a deliberate use (say, pickle in an internal tool), the author suggests a comment in the file explaining why it's safe.

How to install it
In Claude Code, run /plugin marketplace add alirezarezvani/claude-skills, then /plugin install security-guidance@claude-code-skills.

Good to know
- It's a community plugin, not Anthropic's.
- The checks are plain text matches, so expect some false positives. For stricter checks, the author suggests adding a SAST tool such as Semgrep or CodeQL to CI.
- Turn it off for one session with ENABLE_SECURITY_REMINDER=0.
- It keeps per-session state and a debug log in ~/.claude/.

- Type: Plugin
- Made by: alirezarezvani
- Category: Security
- Formats: Claude plugins
- Version: 2.14.1
- Website: https://github.com/alirezarezvani/claude-skills/tree/main/engineering/security-guidance
- Source: https://github.com/alirezarezvani/claude-skills/tree/HEAD/engineering/security-guidance
- Page: https://pluginboard.ai/plugins/security-guidance-rezvani

## Works with

- Claude
- GitHub Copilot
- Claude Code
- OpenClaw

## Install

### Claude

In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter alirezarezvani/claude-skills, then add security-guidance

### Claude Code

In Claude Code:

```text
/plugin marketplace add alirezarezvani/claude-skills
/plugin install security-guidance@claude-code-skills
```

---
From Pluginboard (https://pluginboard.ai).