Security Guidance · AlexBramall
PreToolUse security reminder hook for Claude Code. Catches 12 common security anti-patterns in Edit/Write/MultiEdit operations BEFORE they happen — command injection (exec, os.system, subprocess shell=True), XSS (innerHTML, dangerouslySetInnerHTML, document.write), SQL injection (f-string queries, .format), unsafe deserialization (pickle, yaml.unsafeload), code injection (eval, new Function), and GitHub Actions workflow injection. Session-state caching prevents duplicate warnings; 30-day auto-c
Works with: Claude Code (native)
native: this artifact type is that client's own format
Category: Dev Tools & CI — see all ranked ›
Install (Claude Code):
/plugin marketplace add AlexBramall/claude-code-skills
/plugin install security-guidance@claude-code-skills- tashan score: 37.0
- Adoption: 1 repos
- Upkeep: 89.0
- Freshness: 76.0
- Evidence coverage: 84% of the inputs this score can use — the rest are unknown, and the score is discounted for it
- Health: active
- Contributors: 30
- License: MIT
Security audit
Not scanned yet. We audit npm-published capabilities for known advisories, install-time scripts and permission surface; this one has no npm package we can resolve, or has not reached the queue.
source ↗ · plugin:alexbramall/claude-code-skills/security-guidance
Already running this? npx tashan-cli doctor checks your whole config against the Index — how it works ›
Measured 2026-08-05 · scorer s5 · how · something wrong here?