skills.rest
Femad-6
Femad-6COMMUNITY
Explore all skills by this author →
WebsiteGitHub

perl-security

Applies secure coding patterns for Perl covering taint mode, input validation, DBI queries, and web security.

Updated Mar 25, 2026
Search Tags:#security#input validation#sql injection#dbi#perl#taint mode#perlcritic
One-click install
npx skills add https://github.com/Femad-6/my-skills --skill perl-security-femad-6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: perl-security
Source: https://github.com/Femad-6/my-skills/tree/main/.github/skills/perl-security
Command: npx skills add https://github.com/Femad-6/my-skills --skill perl-security-femad-6

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Perl applications that handle user input, execute system commands, or query databases are vulnerable to injection attacks, path traversal, XSS, and ReDoS when written without disciplined security patterns. This Skill provides concrete, copy-ready secure coding guidelines so Perl code resists these common vulnerability classes. ## Core Features & Use Cases - Taint Mode & Input Validation: Enable -T taint checking, untaint data with strict allowlist regexes, and enforce length constraints on all external input. - Injection Prevention: Use three-argument open, list-form system calls, and DBI parameterized queries to eliminate command and SQL injection. - Web Security: Encode output with HTML::Entities, generate CSRF tokens, configure secure sessions and headers for Mojolicious, Dancer2, and Catalyst apps. - Use Case: When reviewing a legacy CGI script, apply this Skill to convert two-arg opens to three-arg opens, replace string-form system calls with list form, and add perlcritic security policies to CI. ## Quick Start Review my Perl script for security vulnerabilities and rewrite any unsafe file operations, system calls, and SQL queries using the secure patterns.

Frequently Asked Questions about perl-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Perl DBI queries?▼

Use DBI placeholders with prepare and execute instead of interpolating variables into SQL strings. Pass user values as execute arguments, and validate dynamic column names against an allowlist before including them in ORDER BY clauses.

How to safely execute system commands in Perl?▼

Use the list form of system or exec, such as system('grep', '-r', $pattern, $dir), which bypasses shell interpretation. For capturing output, use IPC::Run3 or Capture::Tiny instead of backticks with interpolated variables.

What is Perl taint mode and when should I use it?▼

Taint mode, enabled with the -T flag, marks all external data as tainted and blocks its use in unsafe operations until validated. Enable it for CGI scripts and any web-facing Perl code, then untaint values with specific allowlist regexes.

Does Perl two-argument open pose a security risk?▼

Yes, two-argument open interprets special characters in filenames, so a path like '|rm -rf /' executes a command. Always use three-argument open with an explicit mode and a lexical filehandle to prevent this injection.

How do I prevent ReDoS attacks in Perl regular expressions?▼

Avoid nested quantifiers like (a+)+ which cause exponential backtracking on crafted input. Rewrite patterns with single quantifiers, use possessive quantifiers or atomic groups, and wrap untrusted matching in an alarm-based timeout.

Which perlcritic policies enforce Perl security best practices?▼

Key security policies include InputOutput::RequireThreeArgOpen, ProhibitTwoArgOpen, ProhibitBacktickOperators, BuiltinFunctions::ProhibitStringyEval, and Modules::RequireTaintChecking. Run perlcritic with the security theme at severity 3 or higher in CI pipelines.

Related Skills

Explore More Software Engineering Skills→
contentbugvideoeditingcontentbugvideoediting

perl-patterns

Standardize Perl 5.36+ codebases with modern syntax and Moo-based OO.

Community
Intermediate
vrcmsvrcms
1

perl-security

Implements Perl security controls including taint mode enforcement and injection prevention via perlcritic static analysis.

Community
Advanced
sk8metalmesk8metalme
1

perl-dev

Provide modern Perl guidance, tooling recommendations, and coding standards.

Community
Advanced
vertivolatamvertivolatam
1

Static Analysis

Run static analysis across multiple programming languages with linters and security scanners.

Official
Advanced