claude-security

Name: claude-security
Availability: InStock
Author: Anthropic

Scan codebases, diffs, and commits for vulnerabilities and generate verified patch files.

35.8k|4.0k|Updated Nov 20, 2025

Search Tags:#vulnerability scan #patch generation #Security #sarif #threat model #Git diff #Code review

Ready to run

npx skills add https://github.com/anthropics/claude-plugins-official --skill claude-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: claude-security
Source: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security/skills/claude-security
Command: npx skills add https://github.com/anthropics/claude-plugins-official --skill claude-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Finding real vulnerabilities in a codebase requires deep review that manual audits and traditional SAST tools often miss or drown in false positives, and turning findings into safe fixes is slow and error-prone.

Core Features & Use Cases

Codebase and change scanning: Scan the whole repository, a scoped directory set, a branch or pull request diff, or a single commit, with effort tiers from low to max.
Adversarial verification panel: Every candidate finding is challenged by independent verifier agents before it reaches the report, keeping false positives out.
Patch suggestion workflow: Confirmed findings are turned into targeted .patch files developed in scratch git workspaces, verified by a panel of agents, and delivered for the user to review and apply.
Use Case: A developer about to merge a feature branch runs a changes scan against main, receives a report with verified findings in Markdown, JSONL, and SARIF formats, then asks for patches on the HIGH findings and applies them with git apply.

Quick Start

Ask Claude to scan this repository for security vulnerabilities at medium effort and confirm when prompted.

Frequently Asked Questions about claude-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for security vulnerabilities with Claude?▼

Invoke the claude-security skill and choose Scan codebase from the menu, or ask directly to scan the repository. You pick the scope and effort tier, confirm the run, and findings are verified by a panel before appearing in the report.

How do I scan only the changes in my branch or pull request?▼

Choose the Scan changes job, which diffs your branch against its base (or a pull request's base) and scans only what changed. You can also pass a commit sha to scan a single commit against its parent.

Does the scan apply fixes or change my code automatically?▼

No. Nothing is auto-applied, committed, or pushed. Suggested fixes are delivered as patch files in a patches folder that you review and apply yourself with git apply when you choose.

Can I scan changes without a git repository?▼

Scanning changes and suggesting patches require a git checkout because they diff committed code. A whole-directory codebase scan still works outside a git repository, and the skill will say so plainly.

Why does the scan ask for confirmation before starting?▼

Scans can run for minutes to tens of minutes and use significant tokens, so a fixed confirmation guards that cost. If your request already acknowledges the time or token cost in words, the confirmation is skipped.

What output formats does the security report produce?▼

Each run writes a human-readable Markdown report, a JSONL file for CI gates, a SARIF log for code-scanning dashboards, and a revision stamp recording what was scanned, at what effort, and its verification status.