claude-security — Claude Code subagent: what it does, install
Scans a repository or its changes, then can turn verified findings into targeted patch files. It runs only as the main agent of a session.
/plugin install claude-security@claude-plugins-officialWhat claude-security does
claude-security scans an entire repository, a scoped part of it, a branch or pull request diff, or a single commit. It can then create targeted patch files for findings that pass verification. The changes are not committed, pushed, or opened as a pull request.
The orchestrator runs the claude-security:scan workflow with research and verification agents. For remediation, it uses a patch generator, a verifier, and a fresh researcher for each finding. A scan asks for confirmation of its time or token cost unless the user has already accepted that cost. If Workflow is unavailable, the scan stops. Run it as the main session agent with claude --agent claude-security:claude-security; do not dispatch it as a subagent.
What it helps with
- scan a repository for security findings
- review changes in a branch or pull request
- inspect a single commit for vulnerabilities
- generate patches for verified findings
- validate proposed fixes with separate agents
Example prompts for the agent
- Run
claude-securityas the main agent withclaude --agent claude-security:claude-securityand scan the whole repository. - Start
claude-securitywithclaude --agent claude-security:claude-security, review this branch’s changes, and prepare patches for findings that pass verification.
How to install claude-security
1Plugin marketplace
/plugin install claude-security@claude-plugins-official2Manually: put the files in place
.claude/agents/claude-security.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/claude-security.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/claude-security.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about claude-security
How do I install claude-security in Claude Code?
Run /plugin install claude-security@claude-plugins-official, then use .claude/agents/claude-security.md.
What does claude-security do?
It scans repositories, changes, or commits and can create targeted patch files from its findings. Each patch is checked by separate agents.
Can I dispatch claude-security as a subagent?
No. It is designed to run as the main agent of a session through claude --agent claude-security:claude-security; it cannot scan when dispatched as a subagent.
