patch-verifier — Claude Code subagent for patch review
Reviews a security fix in a scratch checkout, checks the staged diff and runs the project’s tests. A fix job dispatches it; it is not meant for direct invocation.
/plugin install claude-security@claude-plugins-officialWhat patch-verifier does
patch-verifier checks whether a proposed fix addresses the reported vulnerability without changing unrelated code. It reads the staged diff and changed-path list, checks the workspace state, traces the vulnerable flow through the old and updated code, then returns a verdict. The review covers three claims: the change targets the finding, adds no attack path, and preserves behaviour for other callers.
The subagent works in a scratch clone at the patch base, so the user’s checkout is left untouched. It runs the project’s own tests, but does not install dependencies or fetch tools. When no repository test exercises the changed code, the behaviour claim can rest on code review, and the patch is marked untested.
Its default is to reject. It never edits the workspace and is dispatched by a fix job with a FINDING block and WORKSPACE path. A malformed dispatch or unstaged changes make the review fail closed.
What it helps with
- check whether a patch closes the reported vulnerability
- catch unstaged changes that would not be included in the patch
- trace modified callers for collateral behaviour changes
- run project tests and assess whether they exercise the fix
Example prompts for the agent
- Ask the fix job to dispatch patch-verifier for the finding in FINDING and the scratch checkout at WORKSPACE.
- Have patch-verifier trace the vulnerable flow through the changed code and run the project’s tests.
- Ask the fix job to reject the patch if WORKSPACE contains unstaged changes or unrelated edits.
How to install patch-verifier
1Plugin marketplace
/plugin install claude-security@claude-plugins-official2Manually: put the files in place
.claude/agents/patch-verifier.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/patch-verifier.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/patch-verifier.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about patch-verifier
How do I install patch-verifier in Claude Code?
Run /plugin install claude-security@claude-plugins-official, then use .claude/agents/patch-verifier.md.
What does patch-verifier do?
It reviews a vulnerability fix’s staged diff, runs the project’s tests, and checks for new attack paths or unintended behaviour changes. A fix job dispatches it.
Can I invoke patch-verifier directly?
No. A fix job dispatches it with a FINDING block and WORKSPACE path. It reviews the scratch clone and does not edit it.
