Security Guidance Hook — Security & Safety

Security Guidance Hook is a PreToolUse hook for Claude Code that automatically detects and blocks 12 common security anti-patterns (such as command injection, XSS, SQL injection, and unsafe deserialization) before an Edit, Write, or MultiEdit operation completes. It uses session-state caching to avoid duplicate warnings and requires no dependencies.

engineering claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Detects 12 security anti-patterns including command injection, XSS, SQL injection, unsafe deserialization, and code inje
Scans both file paths (for GitHub Actions workflow patterns) and file content (for substring matches).
Blocks tool calls with exit code 2 when a pattern is first detected, and allows subsequent edits after a warning is show
Uses session-state caching to prevent duplicate warnings for the same file and rule.
Provides a debug log at ~/.claude/security-warnings-log.txt for troubleshooting.
Can be disabled per-session with the ENABLE_SECURITY_REMINDER=0 environment variable.

🎯 When to use it

When you want a safety net during Claude Code sessions that touch security-sensitive code (auth, payments, user input handling, IaC).
When you need to block unsafe code patterns before they are written to files.
When you want to detect command injection, SQL injection, or other dangerous patterns in real-time during development.
When you are working with GitHub Actions workflows and want to prevent workflow injection vulnerabilities.

🚀 How to use

Trigger: /plugin

This skill is a hook, not a slash command. Install it as a plugin using the commands: /plugin marketplace add alirezarezvani/claude-skills and /plugin install security-guidance@claude-code-skills. Once installed, it runs automatically before every Edit, Write, or MultiEdit operation. You can trigger it by asking Claude to 'add security hook' or 'block unsafe code before write', but the hook activates on its own. Example prompts:

Add a security hook to block unsafe code before writing.
Detect command injection patterns in this file.

📄 Output: The hook produces no files; it outputs warnings to stderr and blocks or allows tool calls accordingly.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering/security-guidance/skills/security-guidance .claude/skills/security-guidance

Skill source: engineering/security-guidance/skills/security-guidance/SKILL.md

⚠️ Good to know

The hook uses substring-based detection, which may produce false positives on string literals containing patterns like 'eval('; it is not a substitute for a full SAST tool.

❓ FAQ

How do I disable the security hook for a session?

Set the environment variable ENABLE_SECURITY_REMINDER=0 when starting Claude Code, e.g., ENABLE_SECURITY_REMINDER=0 claude.

What happens if a pattern is detected but the warning was already shown for that file and rule in the same session?

The hook allows the tool call (exit code 0) because the warning was already displayed once, thanks to session-state caching.

Where does the hook store its state and debug logs?

State files are stored in ~/.claude/security_warnings_state_<session_id>.json, and debug logs are written to ~/.claude/security-warnings-log.txt.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.