Engineering · Skill
Security Guidance Hook
Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserialization, eval or GitHub Actions injection. Warns once per file and rule; ENABLE_SECURITY_REMINDER=0 turns it off.
Open in PhởWhat the skill covers
The sections of its instructions, in order.
- 01 What It Catches
- 02 How It Works
- 03 Installation
- 04 Configuration
- 05 Per-File Override Pattern
- 06 Why The Patterns Are Substring-Based (Not AST-Based)
- 07 State Files
- 08 Debug Log
- 09 Source + Attribution
- 10 Anti-Patterns
- Disabling the hook by default
- Modifying the pattern list without security review
- Treating session-state as immutable security policy
- 11 Related Skills
- 12 Trigger Phrases
- 13 More in this skill
Reference files
1 file Phở can open while it uses the skill.
- references/pretooluse_hook_canon.md
More in Engineering review
- PR Review Expert
Review a pull request or diff for bugs, security and quality, file by file. Use whenever the user asks to review a PR or look over their changes.
- Adversarial Code Reviewer
Tough, critical review of a diff or PR before merge, through hostile reviewer personas that catch shared blind spots. Use whenever the user wants a change torn apart, a harsh…
- Database Schema Designer
Use when asked for an ERD, table relationships, normalization or a schema migration plan. Produces the ERD and normalized DDL with migration steps.
- API Test Suite Builder
Use when asked to write API, integration or contract tests for REST endpoints. Builds the suite from the routes: happy paths, auth, validation errors and edge cases per endpoint.
- Focused Fix — Deep-Dive Feature Repair
Use when a whole feature or module is broken and needs fixing end to end ('make X work', 'the Y module is broken'). Maps every file and dependency of the area before changing…
- Stripe Integration Expert
Use for any Stripe integration: subscriptions, trials, proration, checkout, usage billing, webhooks, customer portal or invoicing in Next.js, Express or Django. Writes idempotent…
- LLM Cost Optimizer
Use whenever an LLM feature is being built or its costs come up (model choice, prompt caching, token limits, per-feature spend). Sets routing, caching, max_tokens and cost…
- Prompt Governance
Use when prompts run in production and need versioning, a registry, A/B tests, regression checks or an eval pipeline. Sets up the release process for prompts; single-prompt…
- Zero-Hallucination Coder
Use before high-stakes or multi-file coding (auth, databases, migrations), or when asked to plan carefully and avoid invented APIs. Runs discuss, map, decompose, execute and…
- Embedded / IoT Mentor
Use for any embedded or IoT hardware project (ESP32, STM32, Arduino, Pico, firmware, PCB, MQTT, Home Assistant, sensor dashboards), before buying parts. Picks the MCU, board and…
Similar engineering skills
Frequently asked questions
What does Security Guidance Hook do?
Use when installing or tuning the PreToolUse security hook that warns before Claude writes command injection, XSS, SQL injection, unsafe deserialization, eval or GitHub Actions injection. Warns once per file and rule; ENABLE_SECURITY_REMINDER=0 turns it off.
Is Security Guidance Hook free to use?
Yes. Security Guidance Hook is published by Alireza Rezvani under the MIT licence, and you can use it with a free Phở account.
How do I use Security Guidance Hook in Phở?
Press Open in Phở, then Try to apply it to your next message, or add the Engineering review set so Phở loads it whenever a request matches.
Does Security Guidance Hook need other tools?
No. It works in a normal Phở chat with what you type or upload.
Copied unchanged from alirezarezvani/claude-skills at commit c85b17e and credited to Alireza Rezvani, who is not affiliated with Phở. The full instructions and licence text ship with the skill inside Phở.