Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
Scanned 8/31/2026
Install to Claude Code
Skills Directorynpx -y skills add siva01c/claude-plugins --skill drupal-security-review --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Drupal Security Review?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/siva01c-drupal-security-review)More formats (shields.io, HTML) on the badges page.
---
name: drupal-security-review
description: Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
---
# Drupal Security Review Skill
## Purpose
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
## When to apply
- Reviewing pull requests before merge.
- Auditing custom code for common web vulnerabilities.
- Preparing release readiness checks.
## Review checklist
1. **Input handling**: Validate and sanitize all external input.
2. **Output escaping**: Escape output in Twig and PHP render logic.
3. **Database safety**: Use query builder or placeholders in all SQL operations.
4. **Access control**: Confirm route, entity, and operation permissions are enforced.
5. **Secrets and config**: Ensure credentials are never committed and sensitive config is protected.
## Common anti-patterns to flag
- Direct SQL string concatenation with user data.
- Unescaped raw markup in render arrays.
- Trusting `$_GET`, `$_POST`, or request payloads without validation.
- Debug leftovers (`var_dump`, `kint`, `dpm`) in production paths.
## Useful validation commands
```bash
rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom
```
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
Set up the Globalize CLI, create a translation project, and connect a GitHub or GitLab repository. Use this skill when the user asks to set up Globalize, install the Globalize CLI, authenticate with Globalize, or connect their project to the Globalize translation platform. Also use when the user mentions @globalize-now/cli-client or globalise-now-cli. This skill handles installation, authentication, project creation, and repository connection. For managing existing projects (glossaries, style...
Create, comment on, update, and list Paperclip tasks from Hermes using scoped Paperclip API credentials.
Write a short, colloquial summary for a Paperclip summary slot: open with the 1–3 specific, concrete actions the reader needs to take right now to unblock the work, then a brief plain-language status, streaming progress as it works.
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취...
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
