메뉴
Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Safe deployment workflow for Drupal 10/11 sites: pre-flight checks, backup, the correct update sequence (composer install, database updates, config import, cache rebuild), verification, and rollback plan. Use when deploying to any environment, releasing to production, or when the user asks to "push changes live", "update the server", or run a release. Also use for multisite releases where each site needs its own database update pass.
Phased workflow for delivering a Drupal feature or non-trivial change: plan, implement, review, test, finalize. Use when building a new custom module, adding a route/form/plugin, changing entity structure or schema, or any task touching more than a couple of files. Do NOT use for typo fixes, CSS tweaks, or single-line changes — use the tiny-fix skill instead. Each phase has an exit condition; do not move to the next phase until it is met.
Low-ceremony workflow for trivial, low-risk changes: typos, comments, CSS/styling tweaks, string changes, single-line fixes with no logic impact. Use to avoid the overhead of the full feature workflow when the change cannot break anything. If during the fix the change turns out to touch logic, security, config, or schema, stop and escalate to the feature-workflow skill.
Use this skill when authoring or debugging GitHub Actions workflows (.github/workflows/*.yml) — e.g. "add CI for this Drupal project on GitHub", "run phpcs/phpstan/phpunit on pull requests", "cache composer dependencies", "deploy over SSH when main is pushed", "why didn't my workflow trigger", or anything involving jobs, matrices, runners, secrets, or reusable workflows.
Use this skill when authoring or debugging GitLab CI/CD pipelines (.gitlab-ci.yml) — e.g. "add a CI pipeline for this Drupal project", "run phpcs/phpstan/phpunit in GitLab CI", "deploy with drush from a pipeline", "why is my job not running", "cache composer dependencies", or anything involving stages, rules, artifacts, environments, or GitLab runners.
Use for operational Drupal 11 workflows in DDEV environments, including safe updates, backup-first procedures, and troubleshooting commands.
| name | drupal-security-review |
| description | Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps. |
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
$_GET, $_POST, or request payloads without validation.var_dump, kint, dpm) in production paths.rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom