skills.rest
anthropics
anthropicsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

claude-security

Scan codebases, diffs, and commits for vulnerabilities and generate verified patch files.

35.8k|4.0k|Updated Nov 20, 2025
Search Tags:#vulnerability scan#patch generation#Security#sarif#threat model#Git diff#Code review
One-click install
npx skills add https://github.com/anthropics/claude-plugins-official --skill claude-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: claude-security
Source: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security/skills/claude-security
Command: npx skills add https://github.com/anthropics/claude-plugins-official --skill claude-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Finding real vulnerabilities in a codebase requires deep review that manual audits and traditional SAST tools often miss or drown in false positives, and turning findings into safe fixes is slow and error-prone.

Core Features & Use Cases

  • Codebase and change scanning: Scan the whole repository, a scoped directory set, a branch or pull request diff, or a single commit, with effort tiers from low to max.
  • Adversarial verification panel: Every candidate finding is challenged by independent verifier agents before it reaches the report, keeping false positives out.
  • Patch suggestion workflow: Confirmed findings are turned into targeted .patch files developed in scratch git workspaces, verified by a panel of agents, and delivered for the user to review and apply.
  • Use Case: A developer about to merge a feature branch runs a changes scan against main, receives a report with verified findings in Markdown, JSONL, and SARIF formats, then asks for patches on the HIGH findings and applies them with git apply.

Quick Start

Ask Claude to scan this repository for security vulnerabilities at medium effort and confirm when prompted.

Frequently Asked Questions about claude-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities with Claude?▼

Invoke the claude-security skill and choose Scan codebase from the menu, or ask directly to scan the repository. You pick the scope and effort tier, confirm the run, and findings are verified by a panel before appearing in the report.

How do I scan only the changes in my branch or pull request?▼

Choose the Scan changes job, which diffs your branch against its base (or a pull request's base) and scans only what changed. You can also pass a commit sha to scan a single commit against its parent.

Does the scan apply fixes or change my code automatically?▼

No. Nothing is auto-applied, committed, or pushed. Suggested fixes are delivered as patch files in a patches folder that you review and apply yourself with git apply when you choose.

Can I scan changes without a git repository?▼

Scanning changes and suggesting patches require a git checkout because they diff committed code. A whole-directory codebase scan still works outside a git repository, and the skill will say so plainly.

Why does the scan ask for confirmation before starting?▼

Scans can run for minutes to tens of minutes and use significant tokens, so a fixed confirmation guards that cost. If your request already acknowledges the time or token cost in words, the confirmation is skipped.

What output formats does the security report produce?▼

Each run writes a human-readable Markdown report, a JSONL file for CI gates, a SARIF log for code-scanning dashboards, and a revision stamp recording what was scanned, at what effort, and its verification status.

Related Skills

Explore More Software Engineering Skills→
brandon-frysliebrandon-fryslie
4

organize-commits

Review and organize uncommitted Git changes into logical commits.

Community
Advanced
stephanesoaresstephanesoares

fix-github-issue

Automate GitHub issue fixes by creating feature branches, running tests, and opening pull requests.

Community
Intermediate
endorlabsendorlabs
2

endor-scan

Scan code repositories for vulnerabilities, secrets, and SAST issues.

Official
Advanced
PriyanshKuniyalPriyanshKuniyal

sast-configuration

Configures and manages SAST tools for automated vulnerability detection in CI/CD pipelines.

Community
Advanced