security-guidance plugin
PreToolUse security reminder hook for Claude Code. Catches 12 common security anti-patterns in Edit/Write/MultiEdit operations BEFORE they happen — command injection (exec, os.system, subprocess shell=True), XSS (innerHTML, dangerouslySetInnerHTML, document.write), SQL injection (f-string queries, .format), unsafe deserialization (pickle, yaml.unsafe_load), code injection (eval, new Function), and GitHub Actions workflow injection. Session-state caching prevents duplicate warnings; 30-day auto-cleanup. Disable per-session with ENABLE_SECURITY_REMINDER=0. Ported from David Dworken at Anthropic.
How to install the security-guidance plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add alirezarezvani/claude-skills
/plugin install security-guidance@claude-code-skillsWhat's inside security-guidance
2 parts read from the plugin's own files.
Skills 1
Claude loads it when the task matches- security-guidance
No description in the file.
Hooks 1
Runs on these events- hooks
No description in the file.
Using security-guidance in Claude Code
Skills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update security-guidance@claude-code-skills
- Refresh the marketplace
- /plugin marketplace update claude-code-skills
- Turn it off for now
- /plugin disable security-guidance@claude-code-skills
- Remove it
- /plugin uninstall security-guidance@claude-code-skills
security-guidance plugin questions
How do I install the security-guidance plugin?
In Claude Code run /plugin marketplace add alirezarezvani/claude-skills, then /plugin install security-guidance@claude-code-skills.
What does the security-guidance plugin include?
security-guidance bundles 1 skill, hooks.
How do I update or remove the security-guidance plugin?
Update it with claude plugin update security-guidance@claude-code-skills in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall security-guidance@claude-code-skills.