[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6JDBRFKEVQFJCB4RMV6AFZ8":3,"skill-same:01M6JDBRFKEVQFJCB4RMV6AFZ8":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":44,"ownerHtmlUrl":45,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":46,"install":47,"resources":60},"01M6JDBRFKEVQFJCB4RMV6AFZ8","perl-security",null,"Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS\u002FSQLi\u002FCSRF), and perlcritic security policies.","S3YED\u002Fappie-kit","S3YED","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F62743867?v=4","01M6JBKBRRVP6KMS0VWZ27T3R6","01M6JBKBX0KG30284PW1DBYJT1",14,"MIT","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fecc\u002Fperl-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32],"security","perl security","perl","safe","web","validation","execution","sqli","xss","csrf","process","queries","input","Input Validation","mode","2026-11-10 10:12:30",false,"---\nname: perl-security\ndescription: Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS\u002FSQLi\u002FCSRF), and perlcritic security policies.\norigin: ECC\n---\n\n# Perl Security Patterns\n\nComprehensive security guidelines for Perl applications covering input validation, injection prevention, and secure coding practices.\n\n## When to Activate\n\n- Handling user input in Perl applications\n- Building Perl web applications (CGI, Mojolicious, Dancer2, Catalyst)\n- Reviewing Perl code for security vulnerabilities\n- Performing file operations with user-supplied paths\n- Executing system commands from Perl\n- Writing DBI database queries\n\n## How It Works\n\nStart with taint-aware input boundaries, then move outward: validate and untaint inputs, keep filesystem and process execution constrained, and use parameterized DBI queries everywhere. The examples below show the safe defaults this skill expects you to apply before shipping Perl code that touches user input, the shell, or the network.\n\n## Taint Mode\n\nPerl's taint mode (`-T`) tracks data from external sources and prevents it from being used in unsafe operations without explicit validation.\n\n### Enabling Taint Mode\n\n```perl\n#!\u002Fusr\u002Fbin\u002Fperl -T\nuse v5.36;\n\n# Tainted: anything from outside the program\nmy $input    = $ARGV[0];        # Tainted\nmy $env_path = $ENV{PATH};      # Tainted\nmy $form     = \u003CSTDIN>;         # Tainted\nmy $query    = $ENV{QUERY_STRING}; # Tainted\n\n# Sanitize PATH early (required in taint mode)\n$ENV{PATH} = '\u002Fusr\u002Flocal\u002Fbin:\u002Fusr\u002Fbin:\u002Fbin';\ndelete @ENV{qw(IFS CDPATH ENV BASH_ENV)};\n```\n\n### Untainting Pattern\n\n```perl\nuse v5.36;\n\n# Good: Validate and untaint with a specific regex\nsub untaint_username($input) {\n    if ($input =~ \u002F^([a-zA-Z0-9_]{3,30})$\u002F) {\n        return $1;  # $1 is untainted\n    }\n    die \"Invalid username: must be 3-30 alphanumeric characters\\n\";\n}\n\n# Good: Validate and untaint a file path\nsub untaint_filename($input) {\n    if ($input =~ m{^([a-zA-Z0-9._-]+)$}) {\n        return $1;\n    }\n    die \"Invalid filename: contains unsafe characters\\n\";\n}\n\n# Bad: Overly permissive untainting (defeats the purpose)\nsub bad_untaint($input) {\n    $input =~ \u002F^(.*)$\u002Fs;\n    return $1;  # Accepts ANYTHING — pointless\n}\n```\n\n## Input Validation\n\n### Allowlist Over Blocklist\n\n```perl\nuse v5.36;\n\n# Good: Allowlist — define exactly what's permitted\nsub validate_sort_field($field) {\n    my %allowed = map { $_ => 1 } qw(name email created_at updated_at);\n    die \"Invalid sort field: $field\\n\" unless $allowed{$field};\n    return $field;\n}\n\n# Good: Validate with specific patterns\nsub validate_email($email) {\n    if ($email =~ \u002F^([a-zA-Z0-9._%+-]+\\@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})$\u002F) {\n        return $1;\n    }\n    die \"Invalid email address\\n\";\n}\n\nsub validate_integer($input) {\n    if ($input =~ \u002F^(-?\\d{1,10})$\u002F) {\n        return $1 + 0;  # Coerce to number\n    }\n    die \"Invalid integer\\n\";\n}\n\n# Bad: Blocklist — always incomplete\nsub bad_validate($input) {\n    die \"Invalid\" if $input =~ \u002F[\u003C>\"';&|]\u002F;  # Misses encoded attacks\n    return $input;\n}\n```\n\n### Length Constraints\n\n```perl\nuse v5.36;\n\nsub validate_comment($text) {\n    die \"Comment is required\\n\"        unless length($text) > 0;\n    die \"Comment exceeds 10000 chars\\n\" if length($text) > 10_000;\n    return $text;\n}\n```\n\n## Safe Regular Expressions\n\n### ReDoS Prevention\n\nCatastrophic backtracking occurs with nested quantifiers on overlapping patterns.\n\n```perl\nuse v5.36;\n\n# Bad: Vulnerable to ReDoS (exponential backtracking)\nmy $bad_re = qr\u002F^(a+)+$\u002F;           # Nested quantifiers\nmy $bad_re2 = qr\u002F^([a-zA-Z]+)*$\u002F;   # Nested quantifiers on class\nmy $bad_re3 = qr\u002F^(.*?,){10,}$\u002F;    # Repeated greedy\u002Flazy combo\n\n# Good: Rewrite without nesting\nmy $good_re = qr\u002F^a+$\u002F;             # Single quantifier\nmy $good_re2 = qr\u002F^[a-zA-Z]+$\u002F;     # Single quantifier on class\n\n# Good: Use possessive quantifiers or atomic groups to prevent backtracking\nmy $safe_re = qr\u002F^[a-zA-Z]++$\u002F;             # Possessive (5.10+)\nmy $safe_re2 = qr\u002F^(?>a+)$\u002F;                # Atomic group\n\n# Good: Enforce timeout on untrusted patterns\nuse POSIX qw(alarm);\nsub safe_match($string, $pattern, $timeout = 2) {\n    my $matched;\n    eval {\n        local $SIG{ALRM} = sub { die \"Regex timeout\\n\" };\n        alarm($timeout);\n        $matched = $string =~ $pattern;\n        alarm(0);\n    };\n    alarm(0);\n    die $@ if $@;\n    return $matched;\n}\n```\n\n## Safe File Operations\n\n### Three-Argument Open\n\n```perl\nuse v5.36;\n\n# Good: Three-arg open, lexical filehandle, check return\nsub read_file($path) {\n    open my $fh, '\u003C:encoding(UTF-8)', $path\n        or die \"Cannot open '$path': $!\\n\";\n    local $\u002F;\n    my $content = \u003C$fh>;\n    close $fh;\n    return $content;\n}\n\n# Bad: Two-arg open with user data (command injection)\nsub bad_read($path) {\n    open my $fh, $path;        # If $path = \"|rm -rf \u002F\", runs command!\n    open my $fh, \"\u003C $path\";   # Shell metacharacter injection\n}\n```\n\n### TOCTOU Prevention and Path Traversal\n\n```perl\nuse v5.36;\nuse Fcntl qw(:DEFAULT :flock);\nuse File::Spec;\nuse Cwd qw(realpath);\n\n# Atomic file creation\nsub create_file_safe($path) {\n    sysopen(my $fh, $path, O_WRONLY | O_CREAT | O_EXCL, 0600)\n        or die \"Cannot create '$path': $!\\n\";\n    return $fh;\n}\n\n# Validate path stays within allowed directory\nsub safe_path($base_dir, $user_path) {\n    my $real = realpath(File::Spec->catfile($base_dir, $user_path))\n        \u002F\u002F die \"Path does not exist\\n\";\n    my $base_real = realpath($base_dir)\n        \u002F\u002F die \"Base dir does not exist\\n\";\n    die \"Path traversal blocked\\n\" unless $real =~ \u002F^\\Q$base_real\\E(?:\\\u002F|\\z)\u002F;\n    return $real;\n}\n```\n\nUse `File::Temp` for temporary files (`tempfile(UNLINK => 1)`) and `flock(LOCK_EX)` to prevent race conditions.\n\n## Safe Process Execution\n\n### List-Form system and exec\n\n```perl\nuse v5.36;\n\n# Good: List form — no shell interpolation\nsub run_command(@cmd) {\n    system(@cmd) == 0\n        or die \"Command failed: @cmd\\n\";\n}\n\nrun_command('grep', '-r', $user_pattern, '\u002Fvar\u002Flog\u002Fapp\u002F');\n\n# Good: Capture output safely with IPC::Run3\nuse IPC::Run3;\nsub capture_output(@cmd) {\n    my ($stdout, $stderr);\n    run3(\\@cmd, \\undef, \\$stdout, \\$stderr);\n    if ($?) {\n        die \"Command failed (exit $?): $stderr\\n\";\n    }\n    return $stdout;\n}\n\n# Bad: String form — shell injection!\nsub bad_search($pattern) {\n    system(\"grep -r '$pattern' \u002Fvar\u002Flog\u002Fapp\u002F\");  # If $pattern = \"'; rm -rf \u002F #\"\n}\n\n# Bad: Backticks with interpolation\nmy $output = `ls $user_dir`;   # Shell injection risk\n```\n\nAlso use `Capture::Tiny` for capturing stdout\u002Fstderr from external commands safely.\n\n## SQL Injection Prevention\n\n### DBI Placeholders\n\n```perl\nuse v5.36;\nuse DBI;\n\nmy $dbh = DBI->connect($dsn, $user, $pass, {\n    RaiseError => 1,\n    PrintError => 0,\n    AutoCommit => 1,\n});\n\n# Good: Parameterized queries — always use placeholders\nsub find_user($dbh, $email) {\n    my $sth = $dbh->prepare('SELECT * FROM users WHERE email = ?');\n    $sth->execute($email);\n    return $sth->fetchrow_hashref;\n}\n\nsub search_users($dbh, $name, $status) {\n    my $sth = $dbh->prepare(\n        'SELECT * FROM users WHERE name LIKE ? AND status = ? ORDER BY name'\n    );\n    $sth->execute(\"%$name%\", $status);\n    return $sth->fetchall_arrayref({});\n}\n\n# Bad: String interpolation in SQL (SQLi vulnerability!)\nsub bad_find($dbh, $email) {\n    my $sth = $dbh->prepare(\"SELECT * FROM users WHERE email = '$email'\");\n    # If $email = \"' OR 1=1 --\", returns all users\n    $sth->execute;\n    return $sth->fetchrow_hashref;\n}\n```\n\n### Dynamic Column Allowlists\n\n```perl\nuse v5.36;\n\n# Good: Validate column names against an allowlist\nsub order_by($dbh, $column, $direction) {\n    my %allowed_cols = map { $_ => 1 } qw(name email created_at);\n    my %allowed_dirs = map { $_ => 1 } qw(ASC DESC);\n\n    die \"Invalid column: $column\\n\"    unless $allowed_cols{$column};\n    die \"Invalid direction: $direction\\n\" unless $allowed_dirs{uc $direction};\n\n    my $sth = $dbh->prepare(\"SELECT * FROM users ORDER BY $column $direction\");\n    $sth->execute;\n    return $sth->fetchall_arrayref({});\n}\n\n# Bad: Directly interpolating user-chosen column\nsub bad_order($dbh, $column) {\n    $dbh->prepare(\"SELECT * FROM users ORDER BY $column\");  # SQLi!\n}\n```\n\n### DBIx::Class (ORM Safety)\n\n```perl\nuse v5.36;\n\n# DBIx::Class generates safe parameterized queries\nmy @users = $schema->resultset('User')->search({\n    status => 'active',\n    email  => { -like => '%@example.com' },\n}, {\n    order_by => { -asc => 'name' },\n    rows     => 50,\n});\n```\n\n## Web Security\n\n### XSS Prevention\n\n```perl\nuse v5.36;\nuse HTML::Entities qw(encode_entities);\nuse URI::Escape qw(uri_escape_utf8);\n\n# Good: Encode output for HTML context\nsub safe_html($user_input) {\n    return encode_entities($user_input);\n}\n\n# Good: Encode for URL context\nsub safe_url_param($value) {\n    return uri_escape_utf8($value);\n}\n\n# Good: Encode for JSON context\nuse JSON::MaybeXS qw(encode_json);\nsub safe_json($data) {\n    return encode_json($data);  # Handles escaping\n}\n\n# Template auto-escaping (Mojolicious)\n# \u003C%= $user_input %>   — auto-escaped (safe)\n# \u003C%== $raw_html %>    — raw output (dangerous, use only for trusted content)\n\n# Template auto-escaping (Template Toolkit)\n# [% user_input | html %]  — explicit HTML encoding\n\n# Bad: Raw output in HTML\nsub bad_html($input) {\n    print \"\u003Cdiv>$input\u003C\u002Fdiv>\";  # XSS if $input contains \u003Cscript>\n}\n```\n\n### CSRF Protection\n\n```perl\nuse v5.36;\nuse Crypt::URandom qw(urandom);\nuse MIME::Base64 qw(encode_base64url);\n\nsub generate_csrf_token() {\n    return encode_base64url(urandom(32));\n}\n```\n\nUse constant-time comparison when verifying tokens. Most web frameworks (Mojolicious, Dancer2, Catalyst) provide built-in CSRF protection — prefer those over hand-rolled solutions.\n\n### Session and Header Security\n\n```perl\nuse v5.36;\n\n# Mojolicious session + headers\n$app->secrets(['long-random-secret-rotated-regularly']);\n$app->sessions->secure(1);          # HTTPS only\n$app->sessions->samesite('Lax');\n\n$app->hook(after_dispatch => sub ($c) {\n    $c->res->headers->header('X-Content-Type-Options' => 'nosniff');\n    $c->res->headers->header('X-Frame-Options'        => 'DENY');\n    $c->res->headers->header('Content-Security-Policy' => \"default-src 'self'\");\n    $c->res->headers->header('Strict-Transport-Security' => 'max-age=31536000; includeSubDomains');\n});\n```\n\n## Output Encoding\n\nAlways encode output for its context: `HTML::Entities::encode_entities()` for HTML, `URI::Escape::uri_escape_utf8()` for URLs, `JSON::MaybeXS::encode_json()` for JSON.\n\n## CPAN Module Security\n\n- **Pin versions** in cpanfile: `requires 'DBI', '== 1.643';`\n- **Prefer maintained modules**: Check MetaCPAN for recent releases\n- **Minimize dependencies**: Each dependency is an attack surface\n\n## Security Tooling\n\n### perlcritic Security Policies\n\n```ini\n# .perlcriticrc — security-focused configuration\nseverity = 3\ntheme = security + core\n\n# Require three-arg open\n[InputOutput::RequireThreeArgOpen]\nseverity = 5\n\n# Require checked system calls\n[InputOutput::RequireCheckedSyscalls]\nfunctions = :builtins\nseverity = 4\n\n# Prohibit string eval\n[BuiltinFunctions::ProhibitStringyEval]\nseverity = 5\n\n# Prohibit backtick operators\n[InputOutput::ProhibitBacktickOperators]\nseverity = 4\n\n# Require taint checking in CGI\n[Modules::RequireTaintChecking]\nseverity = 5\n\n# Prohibit two-arg open\n[InputOutput::ProhibitTwoArgOpen]\nseverity = 5\n\n# Prohibit bare-word filehandles\n[InputOutput::ProhibitBarewordFileHandles]\nseverity = 5\n```\n\n### Running perlcritic\n\n```bash\n# Check a file\nperlcritic --severity 3 --theme security lib\u002FMyApp\u002FHandler.pm\n\n# Check entire project\nperlcritic --severity 3 --theme security lib\u002F\n\n# CI integration\nperlcritic --severity 4 --theme security --quiet lib\u002F || exit 1\n```\n\n## Quick Security Checklist\n\n| Check | What to Verify |\n|---|---|\n| Taint mode | `-T` flag on CGI\u002Fweb scripts |\n| Input validation | Allowlist patterns, length limits |\n| File operations | Three-arg open, path traversal checks |\n| Process execution | List-form system, no shell interpolation |\n| SQL queries | DBI placeholders, never interpolate |\n| HTML output | `encode_entities()`, template auto-escape |\n| CSRF tokens | Generated, verified on state-changing requests |\n| Session config | Secure, HttpOnly, SameSite cookies |\n| HTTP headers | CSP, X-Frame-Options, HSTS |\n| Dependencies | Pinned versions, audited modules |\n| Regex safety | No nested quantifiers, anchored patterns |\n| Error messages | No stack traces or paths leaked to users |\n\n## Anti-Patterns\n\n```perl\n# 1. Two-arg open with user data (command injection)\nopen my $fh, $user_input;               # CRITICAL vulnerability\n\n# 2. String-form system (shell injection)\nsystem(\"convert $user_file output.png\"); # CRITICAL vulnerability\n\n# 3. SQL string interpolation\n$dbh->do(\"DELETE FROM users WHERE id = $id\");  # SQLi\n\n# 4. eval with user input (code injection)\neval $user_code;                         # Remote code execution\n\n# 5. Trusting $ENV without sanitizing\nmy $path = $ENV{UPLOAD_DIR};             # Could be manipulated\nsystem(\"ls $path\");                      # Double vulnerability\n\n# 6. Disabling taint without validation\n($input) = $input =~ \u002F(.*)\u002Fs;           # Lazy untaint — defeats purpose\n\n# 7. Raw user data in HTML\nprint \"\u003Cdiv>Welcome, $username!\u003C\u002Fdiv>\";  # XSS\n\n# 8. Unvalidated redirects\nprint $cgi->redirect($user_url);         # Open redirect\n```\n\n**Remember**: Perl's flexibility is powerful but requires discipline. Use taint mode for web-facing code, validate all input with allowlists, use DBI placeholders for every query, and encode all output for its context. Defense in depth — never rely on a single layer.\n","# Perl Security Patterns\n\nComprehensive security guidelines for Perl applications covering input validation, injection prevention, and secure coding practices.\n\n## When to Activate\n\n- Handling user input in Perl applications\n- Building Perl web applications (CGI, Mojolicious, Dancer2, Catalyst)\n- Reviewing Perl code for security vulnerabilities\n- Performing file operations with user-supplied paths\n- Executing system commands from Perl\n- Writing DBI database queries\n\n## How It Works\n\nStart with taint-aware input boundaries, then move outward: validate and untaint inputs, keep filesystem and process execution constrained, and use parameterized DBI queries everywhere. The examples below show the safe defaults this skill expects you to apply before shipping Perl code that touches user input, the shell, or the network.\n\n## Taint Mode\n\nPerl's taint mode (`-T`) tracks data from external sources and prevents it from being used in unsafe operations without explicit validation.\n\n### Enabling Taint Mode\n\n```perl\n#!\u002Fusr\u002Fbin\u002Fperl -T\nuse v5.36;\n\n# Tainted: anything from outside the program\nmy $input    = $ARGV[0];        # Tainted\nmy $env_path = $ENV{PATH};      # Tainted\nmy $form     = \u003CSTDIN>;         # Tainted\nmy $query    = $ENV{QUERY_STRING}; # Tainted\n\n# Sanitize PATH early (required in taint mode)\n$ENV{PATH} = '\u002Fusr\u002Flocal\u002Fbin:\u002Fusr\u002Fbin:\u002Fbin';\ndelete @ENV{qw(IFS CDPATH ENV BASH_ENV)};\n```\n\n### Untainting Pattern\n\n```perl\nuse v5.36;\n\n# Good: Validate and untaint with a specific regex\nsub untaint_username($input) {\n    if ($input =~ \u002F^([a-zA-Z0-9_]{3,30})$\u002F) {\n        return $1;  # $1 is untainted\n    }\n    die \"Invalid username: must be 3-30 alphanumeric characters\\n\";\n}\n\n# Good: Validate and untaint a file path\nsub untaint_filename($input) {\n    if ($input =~ m{^([a-zA-Z0-9._-]+)$}) {\n        return $1;\n    }\n    die \"Invalid filename: contains unsafe characters\\n\";\n}\n\n# Bad: Overly permissive untainting (defeats the purpose)\nsub bad_untaint($input) {\n    $input =~ \u002F^(.*)$\u002Fs;\n    return $1;  # Accepts ANYTHING — pointless\n}\n```\n\n## Input Validation\n\n### Allowlist Over Blocklist\n\n```perl\nuse v5.36;\n\n# Good: Allowlist — define exactly what's permitted\nsub validate_sort_field($field) {\n    my %allowed = map { $_ => 1 } qw(name email created_at updated_at);\n    die \"Invalid sort field: $field\\n\" unless $allowed{$field};\n    return $field;\n}\n\n# Good: Validate with specific patterns\nsub validate_email($email) {\n    if ($email =~ \u002F^([a-zA-Z0-9._%+-]+\\@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})$\u002F) {\n        return $1;\n    }\n    die \"Invalid email address\\n\";\n}\n\nsub validate_integer($input) {\n    if ($input =~ \u002F^(-?\\d{1,10})$\u002F) {\n        return $1 + 0;  # Coerce to number\n    }\n    die \"Invalid integer\\n\";\n}\n\n# Bad: Blocklist — always incomplete\nsub bad_validate($input) {\n    die \"Invalid\" if $input =~ \u002F[\u003C>\"';&|]\u002F;  # Misses encoded attacks\n    return $input;\n}\n```\n\n### Length Constraints\n\n```perl\nuse v5.36;\n\nsub validate_comment($text) {\n    die \"Comment is required\\n\"        unless length($text) > 0;\n    die \"Comment exceeds 10000 chars\\n\" if length($text) > 10_000;\n    return $text;\n}\n```\n\n## Safe Regular Expressions\n\n### ReDoS Prevention\n\nCatastrophic backtracking occurs with nested quantifiers on overlapping patterns.\n\n```perl\nuse v5.36;\n\n# Bad: Vulnerable to ReDoS (exponential backtracking)\nmy $bad_re = qr\u002F^(a+)+$\u002F;           # Nested quantifiers\nmy $bad_re2 = qr\u002F^([a-zA-Z]+)*$\u002F;   # Nested quantifiers on class\nmy $bad_re3 = qr\u002F^(.*?,){10,}$\u002F;    # Repeated greedy\u002Flazy combo\n\n# Good: Rewrite without nesting\nmy $good_re = qr\u002F^a+$\u002F;             # Single quantifier\nmy $good_re2 = qr\u002F^[a-zA-Z]+$\u002F;     # Single quantifier on class\n\n# Good: Use possessive quantifiers or atomic groups to prevent backtracking\nmy $safe_re = qr\u002F^[a-zA-Z]++$\u002F;             # Possessive (5.10+)\nmy $safe_re2 = qr\u002F^(?>a+)$\u002F;                # Atomic group\n\n# Good: Enforce timeout on untrusted patterns\nuse POSIX qw(alarm);\nsub safe_match($string, $pattern, $timeout = 2) {\n    my $matched;\n    eval {\n        local $SIG{ALRM} = sub { die \"Regex timeout\\n\" };\n        alarm($timeout);\n        $matched = $string =~ $pattern;\n        alarm(0);\n    };\n    alarm(0);\n    die $@ if $@;\n    return $matched;\n}\n```\n\n## Safe File Operations\n\n### Three-Argument Open\n\n```perl\nuse v5.36;\n\n# Good: Three-arg open, lexical filehandle, check return\nsub read_file($path) {\n    open my $fh, '\u003C:encoding(UTF-8)', $path\n        or die \"Cannot open '$path': $!\\n\";\n    local $\u002F;\n    my $content = \u003C$fh>;\n    close $fh;\n    return $content;\n}\n\n# Bad: Two-arg open with user data (command injection)\nsub bad_read($path) {\n    open my $fh, $path;        # If $path = \"|rm -rf \u002F\", runs command!\n    open my $fh, \"\u003C $path\";   # Shell metacharacter injection\n}\n```\n\n### TOCTOU Prevention and Path Traversal\n\n```perl\nuse v5.36;\nuse Fcntl qw(:DEFAULT :flock);\nuse File::Spec;\nuse Cwd qw(realpath);\n\n# Atomic file creation\nsub create_file_safe($path) {\n    sysopen(my $fh, $path, O_WRONLY | O_CREAT | O_EXCL, 0600)\n        or die \"Cannot create '$path': $!\\n\";\n    return $fh;\n}\n\n# Validate path stays within allowed directory\nsub safe_path($base_dir, $user_path) {\n    my $real = realpath(File::Spec->catfile($base_dir, $user_path))\n        \u002F\u002F die \"Path does not exist\\n\";\n    my $base_real = realpath($base_dir)\n        \u002F\u002F die \"Base dir does not exist\\n\";\n    die \"Path traversal blocked\\n\" unless $real =~ \u002F^\\Q$base_real\\E(?:\\\u002F|\\z)\u002F;\n    return $real;\n}\n```\n\nUse `File::Temp` for temporary files (`tempfile(UNLINK => 1)`) and `flock(LOCK_EX)` to prevent race conditions.\n\n## Safe Process Execution\n\n### List-Form system and exec\n\n```perl\nuse v5.36;\n\n# Good: List form — no shell interpolation\nsub run_command(@cmd) {\n    system(@cmd) == 0\n        or die \"Command failed: @cmd\\n\";\n}\n\nrun_command('grep', '-r', $user_pattern, '\u002Fvar\u002Flog\u002Fapp\u002F');\n\n# Good: Capture output safely with IPC::Run3\nuse IPC::Run3;\nsub capture_output(@cmd) {\n    my ($stdout, $stderr);\n    run3(\\@cmd, \\undef, \\$stdout, \\$stderr);\n    if ($?) {\n        die \"Command failed (exit $?): $stderr\\n\";\n    }\n    return $stdout;\n}\n\n# Bad: String form — shell injection!\nsub bad_search($pattern) {\n    system(\"grep -r '$pattern' \u002Fvar\u002Flog\u002Fapp\u002F\");  # If $pattern = \"'; rm -rf \u002F #\"\n}\n\n# Bad: Backticks with interpolation\nmy $output = `ls $user_dir`;   # Shell injection risk\n```\n\nAlso use `Capture::Tiny` for capturing stdout\u002Fstderr from external commands safely.\n\n## SQL Injection Prevention\n\n### DBI Placeholders\n\n```perl\nuse v5.36;\nuse DBI;\n\nmy $dbh = DBI->connect($dsn, $user, $pass, {\n    RaiseError => 1,\n    PrintError => 0,\n    AutoCommit => 1,\n});\n\n# Good: Parameterized queries — always use placeholders\nsub find_user($dbh, $email) {\n    my $sth = $dbh->prepare('SELECT * FROM users WHERE email = ?');\n    $sth->execute($email);\n    return $sth->fetchrow_hashref;\n}\n\nsub search_users($dbh, $name, $status) {\n    my $sth = $dbh->prepare(\n        'SELECT * FROM users WHERE name LIKE ? AND status = ? ORDER BY name'\n    );\n    $sth->execute(\"%$name%\", $status);\n    return $sth->fetchall_arrayref({});\n}\n\n# Bad: String interpolation in SQL (SQLi vulnerability!)\nsub bad_find($dbh, $email) {\n    my $sth = $dbh->prepare(\"SELECT * FROM users WHERE email = '$email'\");\n    # If $email = \"' OR 1=1 --\", returns all users\n    $sth->execute;\n    return $sth->fetchrow_hashref;\n}\n```\n\n### Dynamic Column Allowlists\n\n```perl\nuse v5.36;\n\n# Good: Validate column names against an allowlist\nsub order_by($dbh, $column, $direction) {\n    my %allowed_cols = map { $_ => 1 } qw(name email created_at);\n    my %allowed_dirs = map { $_ => 1 } qw(ASC DESC);\n\n    die \"Invalid column: $column\\n\"    unless $allowed_cols{$column};\n    die \"Invalid direction: $direction\\n\" unless $allowed_dirs{uc $direction};\n\n    my $sth = $dbh->prepare(\"SELECT * FROM users ORDER BY $column $direction\");\n    $sth->execute;\n    return $sth->fetchall_arrayref({});\n}\n\n# Bad: Directly interpolating user-chosen column\nsub bad_order($dbh, $column) {\n    $dbh->prepare(\"SELECT * FROM users ORDER BY $column\");  # SQLi!\n}\n```\n\n### DBIx::Class (ORM Safety)\n\n```perl\nuse v5.36;\n\n# DBIx::Class generates safe parameterized queries\nmy @users = $schema->resultset('User')->search({\n    status => 'active',\n    email  => { -like => '%@example.com' },\n}, {\n    order_by => { -asc => 'name' },\n    rows     => 50,\n});\n```\n\n## Web Security\n\n### XSS Prevention\n\n```perl\nuse v5.36;\nuse HTML::Entities qw(encode_entities);\nuse URI::Escape qw(uri_escape_utf8);\n\n# Good: Encode output for HTML context\nsub safe_html($user_input) {\n    return encode_entities($user_input);\n}\n\n# Good: Encode for URL context\nsub safe_url_param($value) {\n    return uri_escape_utf8($value);\n}\n\n# Good: Encode for JSON context\nuse JSON::MaybeXS qw(encode_json);\nsub safe_json($data) {\n    return encode_json($data);  # Handles escaping\n}\n\n# Template auto-escaping (Mojolicious)\n# \u003C%= $user_input %>   — auto-escaped (safe)\n# \u003C%== $raw_html %>    — raw output (dangerous, use only for trusted content)\n\n# Template auto-escaping (Template Toolkit)\n# [% user_input | html %]  — explicit HTML encoding\n\n# Bad: Raw output in HTML\nsub bad_html($input) {\n    print \"\u003Cdiv>$input\u003C\u002Fdiv>\";  # XSS if $input contains \u003Cscript>\n}\n```\n\n### CSRF Protection\n\n```perl\nuse v5.36;\nuse Crypt::URandom qw(urandom);\nuse MIME::Base64 qw(encode_base64url);\n\nsub generate_csrf_token() {\n    return encode_base64url(urandom(32));\n}\n```\n\nUse constant-time comparison when verifying tokens. Most web frameworks (Mojolicious, Dancer2, Catalyst) provide built-in CSRF protection — prefer those over hand-rolled solutions.\n\n### Session and Header Security\n\n```perl\nuse v5.36;\n\n# Mojolicious session + headers\n$app->secrets(['long-random-secret-rotated-regularly']);\n$app->sessions->secure(1);          # HTTPS only\n$app->sessions->samesite('Lax');\n\n$app->hook(after_dispatch => sub ($c) {\n    $c->res->headers->header('X-Content-Type-Options' => 'nosniff');\n    $c->res->headers->header('X-Frame-Options'        => 'DENY');\n    $c->res->headers->header('Content-Security-Policy' => \"default-src 'self'\");\n    $c->res->headers->header('Strict-Transport-Security' => 'max-age=31536000; includeSubDomains');\n});\n```\n\n## Output Encoding\n\nAlways encode output for its context: `HTML::Entities::encode_entities()` for HTML, `URI::Escape::uri_escape_utf8()` for URLs, `JSON::MaybeXS::encode_json()` for JSON.\n\n## CPAN Module Security\n\n- **Pin versions** in cpanfile: `requires 'DBI', '== 1.643';`\n- **Prefer maintained modules**: Check MetaCPAN for recent releases\n- **Minimize dependencies**: Each dependency is an attack surface\n\n## Security Tooling\n\n### perlcritic Security Policies\n\n```ini\n# .perlcriticrc — security-focused configuration\nseverity = 3\ntheme = security + core\n\n# Require three-arg open\n[InputOutput::RequireThreeArgOpen]\nseverity = 5\n\n# Require checked system calls\n[InputOutput::RequireCheckedSyscalls]\nfunctions = :builtins\nseverity = 4\n\n# Prohibit string eval\n[BuiltinFunctions::ProhibitStringyEval]\nseverity = 5\n\n# Prohibit backtick operators\n[InputOutput::ProhibitBacktickOperators]\nseverity = 4\n\n# Require taint checking in CGI\n[Modules::RequireTaintChecking]\nseverity = 5\n\n# Prohibit two-arg open\n[InputOutput::ProhibitTwoArgOpen]\nseverity = 5\n\n# Prohibit bare-word filehandles\n[InputOutput::ProhibitBarewordFileHandles]\nseverity = 5\n```\n\n### Running perlcritic\n\n```bash\n# Check a file\nperlcritic --severity 3 --theme security lib\u002FMyApp\u002FHandler.pm\n\n# Check entire project\nperlcritic --severity 3 --theme security lib\u002F\n\n# CI integration\nperlcritic --severity 4 --theme security --quiet lib\u002F || exit 1\n```\n\n## Quick Security Checklist\n\n| Check | What to Verify |\n|---|---|\n| Taint mode | `-T` flag on CGI\u002Fweb scripts |\n| Input validation | Allowlist patterns, length limits |\n| File operations | Three-arg open, path traversal checks |\n| Process execution | List-form system, no shell interpolation |\n| SQL queries | DBI placeholders, never interpolate |\n| HTML output | `encode_entities()`, template auto-escape |\n| CSRF tokens | Generated, verified on state-changing requests |\n| Session config | Secure, HttpOnly, SameSite cookies |\n| HTTP headers | CSP, X-Frame-Options, HSTS |\n| Dependencies | Pinned versions, audited modules |\n| Regex safety | No nested quantifiers, anchored patterns |\n| Error messages | No stack traces or paths leaked to users |\n\n## Anti-Patterns\n\n```perl\n# 1. Two-arg open with user data (command injection)\nopen my $fh, $user_input;               # CRITICAL vulnerability\n\n# 2. String-form system (shell injection)\nsystem(\"convert $user_file output.png\"); # CRITICAL vulnerability\n\n# 3. SQL string interpolation\n$dbh->do(\"DELETE FROM users WHERE id = $id\");  # SQLi\n\n# 4. eval with user input (code injection)\neval $user_code;                         # Remote code execution\n\n# 5. Trusting $ENV without sanitizing\nmy $path = $ENV{UPLOAD_DIR};             # Could be manipulated\nsystem(\"ls $path\");                      # Double vulnerability\n\n# 6. Disabling taint without validation\n($input) = $input =~ \u002F(.*)\u002Fs;           # Lazy untaint — defeats purpose\n\n# 7. Raw user data in HTML\nprint \"\u003Cdiv>Welcome, $username!\u003C\u002Fdiv>\";  # XSS\n\n# 8. Unvalidated redirects\nprint $cgi->redirect($user_url);         # Open redirect\n```\n\n**Remember**: Perl's flexibility is powerful but requires discipline. Use taint mode for web-facing code, validate all input with allowlists, use DBI placeholders for every query, and encode all output for its context. Defense in depth — never rely on a single layer.\n",{"name":5,"origin":38,"description":7},"ECC","master","8ec37df6d71fb664ea19d32c079e7d3ff931a8e0","skills\u002Fecc\u002Fperl-security",3,"https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit","https:\u002F\u002Fweblyfe.ai","https:\u002F\u002Fgithub.com\u002FS3YED","2026-08-27 01:54:02",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add S3YED\u002Fappie-kit --skill perl-security",{"tool":53,"command":54},"bunx","bunx skills add S3YED\u002Fappie-kit --skill perl-security",{"tool":56,"command":57},"pnpm","pnpm dlx skills add S3YED\u002Fappie-kit --skill perl-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fecc\u002Fperl-security\u002FSKILL.md",true,[],[62,98,133,158,189,214],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":79,"publishedAt":33},"01M6JFD4M6N4DSGC7TXEJ5R3J2","ai-music","AI music generation and audio tools: HeartMuLa lyrics-to-music generation, songwriting craft (+ Suno prompts), and audio spectrogram\u002Ffeature visualization.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fwethlete\u002Fai-music\u002FSKILL.md",[68,73,76],{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":74,"categoryName":75,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":77,"categoryName":78,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000023","Skill与智能体开发",[80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97],"music","ai music","humanizer","visualization","Tools","Audio","hermes","hermes agent","songwriting","suno","lyrics","prompts","heartmula","craft","generation","feature","ai music generation","music generation",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":112,"publishedAt":33},"01M6JFCZE4XNFQFMNZDHKHT5V5","agentic-webdesign-design-system-ingestion","Use v0 Design Systems 2.0, Bolt Design System Agents, or Lovable to generate production UI from a client's real design system components — not generic Tailwind. Use when building a client website where brand consistency matters.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-design-system-ingestion\u002FSKILL.md",[104,107],{"categoryNo":105,"categoryName":106,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"design","agentic","design system","system","ingestion","webdesign","agentic webdesign design system ingestion","components","generate","design systems","website","ui","Tailwind","bolt","lovable","v0","design-system","wed","design system components","appie",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":141,"publishedAt":33},"01M6JFCVPX3913CFAS6QQJ33ZB","agentic-webdesign-agent-elements","Use 21st.dev Agent Elements — 25 shadcn\u002Fui components purpose-built for AI agent UIs. Tool cards (Bash, Edit, Search, Plan, Subagent, MCP), chat, input, streaming. Open source, shadcn-registry install, no runtime lock-in.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fweb-design\u002Fagentic-webdesign-agent-elements\u002FSKILL.md",[139,140],{"categoryNo":77,"categoryName":78,"taxonomyType":71,"taxonomyTypeDesc":72},{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},[114,142,118,143,144,145,120,146,147,148,149,150,151,152,153,154,155,30,156,157],"elements","agentic webdesign agent elements","MCP","ai agent","registry","search","streaming","open source","open","Bash","plan","subagent","edit","install","lock","source",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":33},"01M6JFCQC7H65M9QJ6TRE71BS1","vercel-deployment","Deploy static sites and frontends to Vercel — handles both CLI and REST API paths, including the CLI token sanitization workaround.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fvercel-deployment\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":77,"categoryName":78,"taxonomyType":71,"taxonomyTypeDesc":72},[169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"deployment","vercel deployment","vercel","macos","cli","linux","windows","deploy","vercel deploy","REST","api","site","deploy to vercel","token","rest api","host","sites","paths","sanitization","static site",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":33},"01M6JFCM4SMTXBM5A01BK2YQG1","software-quality-workflows","Umbrella workflow for TDD, debugging, code simplification, spikes, pre-commit review, and debugger-assisted investigation.","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Fsoftware-quality-workflows\u002FSKILL.md",[195],{"categoryNo":77,"categoryName":78,"taxonomyType":71,"taxonomyTypeDesc":72},[197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213],"workflows","quality","software","software quality workflows","review","tdd","workflow","commit","debugging","code","debugger","pre-commit","investigation","code simplification","user","simplification","for",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":227,"publishedAt":33},"01M6JFCGD0M6CEATY01W7YN6DB","react-component-refactoring","Safely refactor large React components into smaller, maintainable pieces using proven patterns","https:\u002F\u002Fgithub.com\u002FS3YED\u002Fappie-kit\u002Fblob\u002Fmaster\u002Fskills\u002Fsoftware-development\u002Freact-component-refactoring\u002FSKILL.md",[220,223,226],{"categoryNo":221,"categoryName":222,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":224,"categoryName":225,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":77,"categoryName":78,"taxonomyType":71,"taxonomyTypeDesc":72},[228,229,230,231,232,233,234,235,172,21,236,120,237,175,238,206,239,240,241,242],"react","component","refactoring","component refactoring","react component","react component refactoring","frontend","writing","typescript","react components","modular","refactor","simplify","patterns","test-driven-development"]