Drupal security review

Skill siva01c/claude-plugins/drupal-dev-tools/skills/drupal-security-review

Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.From its SKILL.md

Install

npx -y skills add siva01c/claude-plugins --skill drupal-security-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

17 stars17 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 2 commands, including `rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom` and 1 more.

SKILL.md

1.3 KB, 251 tokens by cl100k_base, as published. Nobody here has run it

Drupal Security Review Skill

Purpose

Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.

When to apply

Reviewing pull requests before merge.
Auditing custom code for common web vulnerabilities.
Preparing release readiness checks.

Review checklist

Input handling: Validate and sanitize all external input.
Output escaping: Escape output in Twig and PHP render logic.
Database safety: Use query builder or placeholders in all SQL operations.
Access control: Confirm route, entity, and operation permissions are enforced.
Secrets and config: Ensure credentials are never committed and sensitive config is protected.

Common anti-patterns to flag

Direct SQL string concatenation with user data.
Unescaped raw markup in render arrays.
Trusting $_GET, $_POST, or request payloads without validation.
Debug leftovers (var_dump, kint, dpm) in production paths.

Useful validation commands

rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.