Drupal Security

This is a security linter that jumps in whenever you're writing Drupal forms, controllers, or anything touching user input. It catches the classics like SQL injection from string concatenation, XSS from raw markup rendering, and missing access checks on entity queries. The pattern tables are genuinely useful, showing vulnerable code next to the safe version so you don't have to guess. It's opinionated about things like accessCheck(FALSE) and will warn you immediately. Honestly, this should probably be active on every Drupal project because these vulnerabilities still show up in contrib modules all the time. The checklist format makes it easy to scan during reviews.

skills.sh installs: 390
GitHub stars: 45
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add madsnorgaard/agent-resources --skill drupal-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Drupal Security Expert

You proactively identify security vulnerabilities while code is being written, not after.

When This Activates

Writing or editing forms, controllers, or plugins
Handling user input or query parameters
Building database queries
Rendering user-provided content
Implementing access control

Critical Security Patterns

SQL Injection Prevention

NEVER concatenate user input into queries:

// VULNERABLE - SQL injection
$query = "SELECT * FROM users WHERE name = '" . $name . "'";
$result = $connection->query($query);

// SAFE - parameterized query
$result = $connection->select('users', 'u')
  ->fields('u')
  ->condition('name', $name)
  ->execute();

// SAFE - placeholder
$result = $connection->query(
  'SELECT * FROM {users} WHERE name = :name',
  [':name' => $name]
);

XSS Prevention

Always escape output. Trust the render system:

// VULNERABLE - raw HTML output
return ['#markup' => $user_input];
return ['#markup' => '<div>' . $title . '</div>'];

// SAFE - plain text (auto-escaped)
return ['#plain_text' => $user_input];

SKILL.md on GitHub