security-guidance

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

Install

If the official marketplace isn’t added yet, run

Category: Security
Author: Anthropic
GitHub: anthropics/claude-plugins-official

Good for

Instant warnings on Edit/Write for ~25 dangerous patterns, e.g. yaml.load, pickle.load, hardcoded secrets
LLM diff review at the end of each turn, so Claude fixes high-severity findings first
Agentic review on git commit that traces data flow across files to catch IDOR, auth bypass and SSRF

Getting started

Check you have Claude Code CLI v2.1.144 or later and Python 3.8+ on PATH
Run /plugin install security-guidance@claude-plugins-official
Work as usual; warnings and review findings are fed back to Claude automatically
Optionally set SECURITY_REVIEW_MODEL or SG_AGENTIC_MODEL to pick a model

Before you install

The LLM reviews need credentials (Claude Code sign-in, an API key, or a cloud provider config) and use the newest Claude Opus by default. Pattern warnings need no credentials.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

claude-securityOfficial plugin · Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
42crunch-api-security-testingOfficial plugin · Security
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
auth0Official plugin · Security
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.
crowdsecOfficial plugin · Security
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.
crowdstrike-falcon-foundryOfficial plugin · Security
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.