Perl Security

If you're shipping Perl code that touches user input, databases, or system calls, this walks you through the defensive patterns that matter: taint mode with proper untainting, three-argument open to avoid shell injection, list-form system and exec, DBI placeholders for every query, and regex patterns that won't blow up on attacker input. It's thorough on the stuff that actually breaks in production, like TOCTOU races, path traversal, and ReDoS. The examples show both the vulnerable pattern and the fix, which makes code review faster. You'll want this active anytime you're auditing legacy CGI scripts or building anything in Mojolicious or Catalyst that handles untrusted data.

skills.sh installs: 5.9K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill perl-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Perl Security Patterns

Comprehensive security guidelines for Perl applications covering input validation, injection prevention, and secure coding practices.

When to Activate

Handling user input in Perl applications
Building Perl web applications (CGI, Mojolicious, Dancer2, Catalyst)
Reviewing Perl code for security vulnerabilities
Performing file operations with user-supplied paths
Executing system commands from Perl
Writing DBI database queries

How It Works

Start with taint-aware input boundaries, then move outward: validate and untaint inputs, keep filesystem and process execution constrained, and use parameterized DBI queries everywhere. The examples below show the safe defaults this skill expects you to apply before shipping Perl code that touches user input, the shell, or the network.