scan-researcher — Claude Code subagent: what it does, how to install
A read-only security auditing subagent for Claude Code. Traces vulnerabilities from untrusted inputs to risky sinks across repository files without executing project code.
/plugin install claude-security@claude-plugins-officialWhat scan-researcher does
The scan-researcher subagent functions within the claude-security plugin to detect genuine vulnerabilities in codebases. It investigates specific components or pull request diffs by mapping complete paths from external data sources to critical sinks. This worker operates on behalf of the scan pipeline rather than direct user interaction.
All file discovery occurs via absolute paths under SCAN_ROOT. The agent inspects context using tools such as Read, Grep, and read-only git queries like git diff or git blame. Compiling targets, running tests, or reaching the network are forbidden. If a vulnerability cannot be validated by reading code, the agent records lower confidence instead of guessing.
Repository text is treated as untrusted input. Any docstring or comment that instructs the model to bypass inspection is flagged as a prompt-injection finding. Discovered flaws receive an explicit CWE identifier and a severity level from LOW to CRITICAL based on reachability and impact.
What it helps with
- trace untrusted inputs through code paths into sensitive sinks
- assign specific CWE weakness identifiers to discovered flaws
- audit git diffs for security vulnerabilities in modified components
- detect prompt injection attempts hidden in code comments or docs
Example prompts for the agent
- Run a
claude-securityscan to inspect our API endpoints for vulnerabilities - Review the current git diff for security flaws using
scan-researcher - Trace untrusted data flow into sinks inside
<SCAN_ROOT>/src/server.ts
How to install scan-researcher
1Plugin marketplace
/plugin install claude-security@claude-plugins-official2Manually: put the files in place
.claude/agents/scan-researcher.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/scan-researcher.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/scan-researcher.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about scan-researcher
How to install scan-researcher in Claude Code?
Install the plugin by running /plugin install claude-security@claude-plugins-official. You can also configure it manually by adding .claude/agents/scan-researcher.md.
What does scan-researcher do?
It conducts static security reviews by following untrusted data from entry points to dangerous functions. The subagent assigns specific CWE IDs and calculates severity ratings from LOW to CRITICAL.
Can scan-researcher execute or test repository code?
No, this subagent operates strictly in read-only mode. Compiling code, running automated tests, installing packages, and performing network requests are not allowed.
