Help us improve
Share bugs, ideas, or general feedback.
From agentic-security
Blocks code that calls eval(), Function constructor, or other string-to-execution patterns on untrusted input. Refuses the edit and proposes sandboxed alternatives.
npx claudepluginhub clear-capabilities/agentic-security --plugin agentic-securityHow this skill is triggered — by the user, by Claude, or both
Slash command
/agentic-security:security-eval-warnThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Activates **before** you write code that converts a string to executable
Detects SQL, command, and template injection from unsanitized user input reaching interpreters. Flags vulnerable patterns and recommends parameterized queries, array-based shell args, and autoescaping templates.
Audits packages for code injection vulnerabilities via dynamic code generation/evaluation using new Function(), eval(), vm.run*, or template interpolation in JS/TS, Python, Ruby, PHP.
Audits Python code for injection vulnerabilities including command execution (subprocess, os.system), SQL queries (cursor.execute, sqlalchemy.text), eval/exec calls, and template rendering (Jinja2, Mako SSTI).
Share bugs, ideas, or general feedback.
Activates before you write code that converts a string to executable code at runtime, when that string can come from any input source (HTTP body, query, header, file, third-party API, message queue).
You're about to call Edit / Write with a body that contains any of:
eval(x), new Function(x), setTimeout(stringArg, …),
setInterval(stringArg, …), vm.runInNewContext(x), vm.compileFunction(x),
vm.Script(x).runInThisContext().eval(x), exec(x), compile(x, …), __import__(x),
getattr(obj, user_string), globals()[user_string].eval(x), class_eval(x), instance_eval(x), send(x, …),
public_send(x, …).eval($x), assert($x), create_function($x, $y),
call_user_func($x, …).exec(userString), execSync(userString),
child_process.exec(userString) — the user-controlled-shell variant
is covered by security-weak-crypto separately; this skill covers
the literal code-eval families.Mustache.render(x, { __proto__: … }),
Handlebars.compile(userInput) (template injection).Stop. Refuse the edit. Propose the structured alternative.
Name the vuln class. "CWE-94 / Code Injection. Anything that
reaches eval() at runtime is the same as letting the input source
write your code directly."
Diagnose what the user actually wants:
JSON.parse(x) / json.loads(x).dict/object lookup table with
an explicit allow-list of keys; throw on unknown.mathjs.evaluate in a worker, simpleeval
in Python, jsep for AST-only). Or refuse — formulae from
untrusted users is the same shape as eval.import + a switch statement.
Never import(userString).json, not pickle).Show the literal replacement as a 3-line code block.
If the user insists eval is necessary (a documented LISP/Lua-style
feature, a build-time scripting hook), confirm the input source is
trusted (developer-only file in the repo) AND the input goes through
a separate validator BEFORE eval. Document the assumption in a
// agentic-security-ignore: code-injection pragma with a one-line
reason.
/setup --bodyguard — make this skill mandatory on every Edit/scan --uncommitted — scan just-edited files for code-eval shapes/triage --explain CWE-94 — full explanation of code-injection family