perl-security

The `perl-security` skill provides a comprehensive framework for securing Perl applications. It addresses common security challenges such as untrusted user input, unsafe system commands, and database injection vulnerabilities. By integrating taint mode, input validation, safe filesystem and process operations, and parameterized database queries, this skill ensures that Perl developers can enforce strict security practices and prevent exploitation through web and system interfaces. Its emphasis on safe coding patterns helps reduce risks associated with SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and unsafe regular expressions.

Key features include activating Perl's taint mode to track and sanitize external data, strict untainting patterns using allowlists and validated regexes, safe handling of system and file operations, and secure construction of database queries using DBI parameterization. The skill also provides guidance on preventing ReDoS attacks by avoiding nested quantifiers in regular expressions, ensuring that applications are resilient to both logical and performance-based vulnerabilities. Perlcritic security policies can further guide developers to enforce consistent security practices across codebases.

This skill is particularly valuable for developers building Perl web applications with frameworks like CGI, Mojolicious, Dancer2, or Catalyst, as well as for security auditors and code reviewers tasked with assessing Perl applications. It is suitable for any situation where user input, file operations, system commands, or database interactions need to be handled securely. By applying these patterns, developers can ship safer code, reduce exposure to attacks, and maintain a higher standard of security compliance within Perl projects.