# drupal-security

A coding-agent skill that nudges you toward safe Drupal patterns: parameterized queries, escaped output, permission checks. It activates on its own while you write forms, controllers or handle user input.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 823 installs · ★ 49
- Author: madsnorgaard
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/madsnorgaard/drupal-agent-resources/tree/HEAD/.claude/skills/drupal-security/SKILL.md
- Updated: 2026-09-17
- HTML: https://affpapa.org/en/nevibecode/skills/drupal-security

## What it does

The skill fires automatically when the agent writes or edits forms, controllers or plugins, builds database queries, or handles user input. It warns during the edit, not after the commit.

Inside is a walkthrough of the usual holes: string concatenation in SQL, output through `#markup`, `accessCheck(FALSE)` on entity queries, routes missing `_permission`, `{{ var|raw }}` in Twig, hardcoded passwords and keys. Each one comes with a safe alternative: the query builder with `condition()`, placeholders like `:name`, `#plain_text`, `Xss::filterAdmin()`, CSRF tokens for AJAX. File uploads get their own section — check the MIME type, not just the extension.

There is a pre-commit checklist and a red-flag table listing the pattern, the risk and the fix. The skill also suggests four questions for any code: where the data comes from, where it goes, who should reach it, and what happens with malicious input. Treat it as a nudge while you type, not a replacement for a security audit.

Install is one command through `npx skills add`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add madsnorgaard/drupal-agent-resources --skill drupal-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/drupal-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/drupal-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add madsnorgaard/drupal-agent-resources --skill drupal-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/drupal-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add madsnorgaard/drupal-agent-resources --skill drupal-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/drupal-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install madsnorgaard/drupal-agent-resources drupal-security
```

2. **Manually: put the files in place**
- File: `.github/skills/drupal-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add madsnorgaard/drupal-agent-resources --skill drupal-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/madsnorgaard/drupal-agent-resources --path .claude/skills/drupal-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/drupal-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add madsnorgaard/drupal-agent-resources --skill drupal-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/madsnorgaard/drupal-agent-resources/tree/HEAD/.claude/skills/drupal-security/SKILL.md

## When to use it
- Catches XSS, SQL injection and access bypass while the code is being written instead of at review time.
- Gives safe replacements for common Drupal anti-patterns: query builder over concatenation, `#plain_text` over `#markup`, `accessCheck(TRUE)` over `FALSE`.
- Ships a pre-commit checklist and a red-flag table you can run against someone else's code.

## Example prompts
- Install the skill, then ask the agent to write a form or controller — it pulls in the safe patterns on its own.
- During review, ask: "check this code for SQL injection and XSS against Drupal rules".
- Ask "how do I safely render user HTML in Drupal?" and the skill points to `Xss::filterAdmin()` and the right render elements.

## Similar
- [security-review](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — skill · 21300 installs
- [security-auditor](https://affpapa.org/en/nevibecode/skills/ovachiever-security-auditor.md) — skill · 780 installs
- [wordpress-security-validation](https://affpapa.org/en/nevibecode/skills/wordpress-security-validation.md) — skill · 581 installs
- [owasp-security](https://affpapa.org/en/nevibecode/skills/owasp-security.md) — skill · 3000 installs
- [secure-code-review](https://affpapa.org/en/nevibecode/skills/zebbern-secure-code-review.md) — skill · ★ 4676
- [laravel-security](https://affpapa.org/en/nevibecode/skills/laravel-security.md) — skill · 5400 installs

From the same set: [madsnorgaard/drupal-agent-resources](https://affpapa.org/en/nevibecode/by/madsnorgaard/drupal-agent-resources.md) — 3 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md