security
Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.
npx skills add oliver-kriska/claude-elixir-phoenix --skill security --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Elixir/Phoenix Security Reference > **Ash projects**: `AshAuthentication` has its own strategy/token patterns — use the `ash-framework` skill. CSRF, XSS, and secret management patterns below still apply. Quick reference for security patterns in Elixir/Phoenix. ## Iron Laws — Never Violate These 1. **VALIDATE AT BOUNDARIES** — Never trust client input. All data through changesets 2. **NEVER INTERPOLATE USER INPUT** — Use Ecto's `^` operator, never string interpolation 3. **NO String.to_atom WITH USER INPUT** — Atom exhaustion DoS. Use `to_existing_atom/1` 4. **AUTHORIZE EVERYWHERE** — Check in contexts AND re-validate in LiveView events 5. **ESCAPE BY DEFAULT** — Never use `raw/1` with untrusted content 6. **SECRETS NEVER IN CODE** — All secrets in `runtime.exs` from env vars 7. **LIVEVIEW EVENT PARAMS ARE UNTRUSTED** — Users can alter forms, hooks, and every `phx-value-*` in DevTools. Validate and authorize against server-side state before acting ## Quick Patterns ### Timing-Safe Authentication ```elixir def authenticate(email, password) do user = Repo.get_by(User, email: email) cond do user && Argon2.verify_pass(password, user.hashed_password) -> {:ok, user} user -> {:error, :in
- Iron Laws — Never Violate These
- Quick Patterns
- Timing-Safe Authentication
- LiveView Authorization (CRITICAL)
- SQL Injection Prevention
- Quick Decisions
- What to validate?
- What to escape?
- Anti-patterns
- References
What does the security skill do?
Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.
How do I install it?
Run `npx skills add oliver-kriska/claude-elixir-phoenix --skill security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From oliver-kriska/claude-elixir-phoenix, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.