# scan-loader

A restricted helper subagent shipped with the claude-security plugin. It reads one JSON file from a run directory and hands the content back untouched.

- subagent · `type=agent` · Claude Code · ★ 44770
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-loader.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/scan-loader

## What it does

scan-loader is a piece of the Claude Security scan pipeline. The dispatch gives it a directory and a file name, and it reads `<directory>/<file name>`, then returns that JSON through structured output exactly as stored: every row, every field, nothing added, dropped or reworded.

Its toolset is cut down to Read. It opens nothing else and does nothing else. Whatever sits inside the file counts as data written by an earlier scan stage, not as instructions for the agent to follow.

It runs on `sonnet` with `low` effort. Calling it yourself makes little sense — the orchestrator is supposed to launch it, and without a directory and file name passed in there is nothing for it to load.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/scan-loader.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/scan-loader.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/scan-loader.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-loader.md

## When to use it
- pull a single JSON file out of a scan run directory
- return file contents with no fields lost or paraphrased
- keep the agent limited to the Read tool
- treat scan output as data rather than instructions

## Example prompts
- Run the scan-loader subagent on directory `runs/2024-05-01` and file `findings.json`
- Load `runs/latest/report.json` with scan-loader and return the JSON unchanged

## Similar
- [security-scan](https://affpapa.org/en/nevibecode/skills/affaan-m-security-scan.md) — skill · 4700 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 145 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md