drupal-security — Claude Code skill: secure Drupal code

What drupal-security does

The skill fires automatically when the agent writes or edits forms, controllers or plugins, builds database queries, or handles user input. It warns during the edit, not after the commit.

Inside is a walkthrough of the usual holes: string concatenation in SQL, output through #markup, accessCheck(FALSE) on entity queries, routes missing _permission, {{ var|raw }} in Twig, hardcoded passwords and keys. Each one comes with a safe alternative: the query builder with condition(), placeholders like :name, #plain_text, Xss::filterAdmin(), CSRF tokens for AJAX. File uploads get their own section — check the MIME type, not just the extension.

There is a pre-commit checklist and a red-flag table listing the pattern, the risk and the fix. The skill also suggests four questions for any code: where the data comes from, where it goes, who should reach it, and what happens with malicious input. Treat it as a nudge while you type, not a replacement for a security audit.

Install is one command through npx skills add.