菜单
Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Safe deployment workflow for Drupal 10/11 sites: pre-flight checks, backup, the correct update sequence (composer install, database updates, config import, cache rebuild), verification, and rollback plan. Use when deploying to any environment, releasing to production, or when the user asks to "push changes live", "update the server", or run a release. Also use for multisite releases where each site needs its own database update pass.
Phased workflow for delivering a Drupal feature or non-trivial change: plan, implement, review, test, finalize. Use when building a new custom module, adding a route/form/plugin, changing entity structure or schema, or any task touching more than a couple of files. Do NOT use for typo fixes, CSS tweaks, or single-line changes — use the tiny-fix skill instead. Each phase has an exit condition; do not move to the next phase until it is met.
Low-ceremony workflow for trivial, low-risk changes: typos, comments, CSS/styling tweaks, string changes, single-line fixes with no logic impact. Use to avoid the overhead of the full feature workflow when the change cannot break anything. If during the fix the change turns out to touch logic, security, config, or schema, stop and escalate to the feature-workflow skill.
Use this skill when authoring or debugging GitHub Actions workflows (.github/workflows/*.yml) — e.g. "add CI for this Drupal project on GitHub", "run phpcs/phpstan/phpunit on pull requests", "cache composer dependencies", "deploy over SSH when main is pushed", "why didn't my workflow trigger", or anything involving jobs, matrices, runners, secrets, or reusable workflows.
Use this skill when authoring or debugging GitLab CI/CD pipelines (.gitlab-ci.yml) — e.g. "add a CI pipeline for this Drupal project", "run phpcs/phpstan/phpunit in GitLab CI", "deploy with drush from a pipeline", "why is my job not running", "cache composer dependencies", or anything involving stages, rules, artifacts, environments, or GitLab runners.
Use for operational Drupal 11 workflows in DDEV environments, including safe updates, backup-first procedures, and troubleshooting commands.
| name | drupal-security-review |
| description | Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps. |
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
$_GET, $_POST, or request payloads without validation.var_dump, kint, dpm) in production paths.rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom