# patch-verifier

Reviews a security fix in a scratch checkout, checks the staged diff and runs the project’s tests. A fix job dispatches it; it is not meant for direct invocation.

- subagent · `type=agent` · Claude Code · ★ 44635
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/patch-verifier.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/patch-verifier

## What it does

\`patch-verifier` checks whether a proposed fix addresses the reported vulnerability without changing unrelated code. It reads the staged diff and changed-path list, checks the workspace state, traces the vulnerable flow through the old and updated code, then returns a verdict. The review covers three claims: the change targets the finding, adds no attack path, and preserves behaviour for other callers.

The subagent works in a scratch clone at the patch base, so the user’s checkout is left untouched. It runs the project’s own tests, but does not install dependencies or fetch tools. When no repository test exercises the changed code, the behaviour claim can rest on code review, and the patch is marked untested.

Its default is to reject. It never edits the workspace and is dispatched by a fix job with a FINDING block and WORKSPACE path. A malformed dispatch or unstaged changes make the review fail closed.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/patch-verifier.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/patch-verifier.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/patch-verifier.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/patch-verifier.md

## When to use it
- check whether a patch closes the reported vulnerability
- catch unstaged changes that would not be included in the patch
- trace modified callers for collateral behaviour changes
- run project tests and assess whether they exercise the fix

## Example prompts
- Ask the fix job to dispatch patch-verifier for the finding in FINDING and the scratch checkout at WORKSPACE.
- Have patch-verifier trace the vulnerable flow through the changed code and run the project’s tests.
- Ask the fix job to reject the patch if WORKSPACE contains unstaged changes or unrelated edits.

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 129 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md