security-guidance

Topics in the source

• Security Guidance Hook
• What It Catches
• How It Works
• Installation
• Configuration
• Per-File Override Pattern
• Why The Patterns Are Substring-Based (Not AST-Based)
• State Files

A PreToolUse hook that blocks 12 common security anti-patterns before Claude Code writes them. This skill is a hook, not a slash command. Once installed, it runs automatically before every Edit, Write, or MultiEdit operation and warns + blocks if it detects a known dangerous pattern. The hook scans both: The file path being edited — flags GitHub Actions workflow files with risky ${{ }} patterns The content being written — substring matches against 11 anti-patterns | Pattern | Category | Risk | |---|---|---| | GitHub Actions workflow expressions | Path-based | Workflow command injection via untrusted inputs | | childprocess.exec, exec(, execSync( | Substring | Node.js command injection | | new Function | Substring | JS code injection | | eval( | Substring | JS code injection | | dangerouslySetInnerHTML | Substring | React XSS | | document.write | Substring | DOM XSS | | .innerHTML = | Substring | DOM XSS | | pickle | Substring | Python deserialization RCE | | os.system, from os import system | Substring | Python command injection | | shell=True (subprocess) | Substring | Python command injection | | f-string SQL or .format SQL | Substring | SQL injection | | yaml.load(, yaml.unsafel

This is an excerpt. Refer to the complete source and its current requirements.