github-actions
Use this skill when authoring or debugging GitHub Actions workflows (.github/workflows/*.yml) — e.g. "add CI for this Drupal…
@siva01cInstall SkillDevelopment
Skill
/drupal-security-review
Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
Claude Code
$ npx -y skills add siva01c/claude-plugins --skill drupal-security-review --agent claude-code
Codex
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a codex -y
Cursor
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a cursor -y
Gemini CLI
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a gemini-cli -y
GitHub Copilot
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a github-copilot -y
OpenCode
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a opencode -y
Windsurf
$ npx skills add siva01c/claude-plugins --skill drupal-security-review -a windsurf -y
SKILL.md
drupal-security-review.SKILL.mdname: drupal-security-review
description: Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
Drupal Security Review Skill
Purpose
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
When to apply
- Reviewing pull requests before merge.
- Auditing custom code for common web vulnerabilities.
- Preparing release readiness checks.
Review checklist
1. **Input handling**: Validate and sanitize all external input. 2. **Output escaping**: Escape output in Twig and PHP render logic. 3. **Database safety**: Use query builder or placeholders in all SQL operations. 4. **Access control**: Confirm route, entity, and operation permissions are enforced. 5. **Secrets and config**: Ensure credentials are never committed and sensitive config is protected.
Common anti-patterns to flag
- Direct SQL string concatenation with user data.
- Unescaped raw markup in render arrays.
- Trusting `$_GET`, `$_POST`, or request payloads without validation.
- Debug leftovers (`var_dump`, `kint`, `dpm`) in production paths.
Useful validation commands
rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom
For a deterministic scan with triage and ASVS mapping, use the `security-tools:semgrep` skill (Semgrep with custom Drupal rules) before the checklist above and review its findings first.
Read more
name: drupal-security-review description: Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
Drupal Security Review Skill
Purpose
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
When to apply
- Reviewing pull requests before merge.
- Auditing custom code for common web vulnerabilities.
- Preparing release readiness checks.
Review checklist
1. **Input handling**: Validate and sanitize all external input. 2. **Output escaping**: Escape output in Twig and PHP render logic. 3. **Database safety**: Use query builder or placeholders in all SQL operations. 4. **Access control**: Confirm route, entity, and operation permissions are enforced. 5. **Secrets and config**: Ensure credentials are never committed and sensitive config is protected.
Common anti-patterns to flag
- Direct SQL string concatenation with user data.
- Unescaped raw markup in render arrays.
- Trusting `$_GET`, `$_POST`, or request payloads without validation.
- Debug leftovers (`var_dump`, `kint`, `dpm`) in production paths.
Useful validation commands
rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom
For a deterministic scan with triage and ASVS mapping, use the `security-tools:semgrep` skill (Semgrep with custom Drupal rules) before the checklist above and review its findings first.
Ships withclaude-plugins
A curated collection of Claude Code plugins for Drupal development, security, and deployment. Each plugin covers one topic — Drupal itself, DDEV, Docker, CI/CD, git workflows, and security verification — so you install only what you need.
1614 skills1 agent
Stars on GitHub
Momentum
- stars in total
- 16
Other skills on claude-plugins.
@siva01cInstall Skillgitlab-ci
Use this skill when authoring or debugging GitLab CI/CD pipelines (.gitlab-ci.yml) — e.g. "add a CI pipeline for this Drupal…
@siva01cInstall Skilldrupal-ddev-operations
Use for operational Drupal 11 workflows in DDEV environments, including safe updates, backup-first procedures, and…
@siva01cInstall Skilldocker-compose
Use this skill when authoring or editing Docker Compose files (compose.yaml / docker-compose.yml), running multi-container…
@siva01cInstall Skilldocker-model
Use this skill when running local AI models with Docker Model Runner — the `docker model` CLI — e.g. "run an LLM locally with…
@siva01cInstall Skilldrupal-module-developm…
Use when creating or extending Drupal 11 custom modules, including scaffolding, service architecture, and dependency injection…
@siva01cInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about drupal-security-review.
- Which coding agents can use drupal-security-review?
- drupal-security-review installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.