Skip to content
Get packs

Claude Security Scanner

Scans your code or changes for security issues and drafts patch files you review before applying.

Source Download skill
Repository
anthropics/claude-plugins-official
Stars
45,770
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can run a security review of a whole repository, a scoped part of it, or only the changes on a branch, pull request, or single commit. Each reported finding is checked by a separate verifier pass before it appears in a report. The agent can also turn findings into targeted patch files on disk, which you review and apply yourself; nothing is committed, pushed, or opened as a pull request.

Great for

  • Developers who want a second, AI-driven security review of their own repository before merging
  • Teams reviewing a pull request or branch diff for security problems
  • Engineers who want suggested fixes delivered as patch files rather than automatic edits

Skip it if

  • Scanning untrusted or unknown code directly, because the scan runs in your session under your permissions with no isolation layer; the instructions recommend a sandbox runtime for that case
  • Replacing a dedicated, audited security tool or penetration test for compliance-critical systems, since findings come from an AI review

Try asking

  • “Scan this repo for security issues”
  • “Scan my branch's changes for vulnerabilities before I open a pull request”
  • “Scan commit abc1234 with Claude Security”
  • “Suggest patches for the Claude Security findings from the last scan”
Step-by-step guide: how to use Claude Security ScannerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    claude-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip claude-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip claude-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Open the session in the repository and enable auto mode (Shift+Tab or claude --permission-mode auto) so the scan runs with fewer interruptions.
  • Scope a codebase scan to a directory when the full repository is large, and use scan changes for pull-request-sized reviews.
  • Review every patch file yourself before applying it, and treat the verifier panel as an aid rather than a guarantee.

What's inside

  • jobs/scan-changes.md
  • jobs/scan-codebase.md
  • jobs/suggest-patches.md
  • role.md
  • SKILL.md
  • specs/patch-spec.md
  • specs/report-spec.md

Redistributed unmodified from anthropics/claude-plugins-official under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.