Skip to content
cccskills
FreePublished on GitHub

drupal-security-review

Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md1.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Drupal Security Review Skill

Purpose

Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.

When to apply

  • Reviewing pull requests before merge.
  • Auditing custom code for common web vulnerabilities.
  • Preparing release readiness checks.

Review checklist

  1. Input handling: Validate and sanitize all external input.
  2. Output escaping: Escape output in Twig and PHP render logic.
  3. Database safety: Use query builder or placeholders in all SQL operations.
  4. Access control: Confirm route, entity, and operation permissions are enforced.
  5. Secrets and config: Ensure credentials are never committed and sensitive config is protected.

Common anti-patterns to flag

  • Direct SQL string concatenation with user data.
  • Unescaped raw markup in render arrays.
  • Trusting $_GET, $_POST, or request payloads without validation.
  • Debug leftovers (var_dump, kint, dpm) in production paths.

Useful validation commands

rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Safe deployment workflow for Drupal 10/11 sites: pre-flight checks, backup, the correct update sequence (composer install, database updates, config import, cache rebuild), verification, and rollback plan. Use when deploying to any environment, releasing to production, or when the user asks to "push changes live", "update the server", or run a release. Also use for multisite releases where each site needs its own database update pass.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

Use this skill when authoring or editing Docker Compose files (compose.yaml / docker-compose.yml), running multi-container stacks, or containerizing a Drupal/PHP application — e.g. "set up a local Drupal stack with nginx and MariaDB", "add Redis to my compose file", "why won't my containers start", "split dev and prod compose configuration". Also trigger for compose commands (up, down, logs, exec, watch) and healthcheck/dependency issues between services.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

Use this skill when running local AI models with Docker Model Runner — the `docker model` CLI — e.g. "run an LLM locally with Docker", "pull a model from the ai/ namespace", "connect my app to a local model", "use a local model as backend for the Drupal AI module", or when wiring the `models:` top-level element into a compose.yaml. Covers pulling/running models, OpenAI-compatible endpoints, and Compose integration.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

Use for operational Drupal 11 workflows in DDEV environments, including safe updates, backup-first procedures, and troubleshooting commands.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

Use when creating or extending Drupal 11 custom modules, including scaffolding, service architecture, and dependency injection best practices.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

dry

Free

DRY (Don't Repeat Yourself) review rules for code reviews: find the same knowledge — a rule, a constant, a parser, a validation, a protocol detail — implemented in several places that must change together, and tell it apart from code that merely looks alike. Use when reviewing a diff, a pull request or recent changes for duplication, on "DRY review", "is this duplicated", "copy-paste check", or when a review checklist asks for DRY. Pair it with the solid skill for design and with owasp-asvs for security.

The English summary is being prepared. Showing the original description.

siva01c/claude-plugins16Updated Sep 26, 2026

See all skills by siva01c

Report a problem with this skill