# scan-verifier

Takes one candidate vulnerability and tries to knock it down. The Claude Security scan workflow dispatches it; you don't call it yourself.

- subagent · `type=agent` · Claude Code · ★ 44770
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-verifier.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/scan-verifier

## What it does

scan-verifier is one of three voters on a single scanner finding. Each voter gets a lens — reachability, impact, or defenses already in place — and the panel's arithmetic happens outside the models. The subagent just returns an honest vote instead of guessing what the others will say.

Read-only by design: `Read`, `Glob`, `Grep`, `Bash` limited to read-only commands, plus a call to the `Agent(claude-security:explore)` subagent. No builds, no tests, no running code, no network. The repository is addressed by the absolute `SCAN_ROOT` from the dispatch, and git runs as `git -C <SCAN_ROOT> ...`. Assume the working directory is the repo and you may end up verifying the wrong file.

FALSE_POSITIVE is the default verdict. TRUE_POSITIVE needs a confirmed attack path with `file:line` cited for the source, the dangerous operation, and the absence of mitigation between them. Inventing a defense to close a finding is the same mistake in reverse, so only a mitigation that was actually read counts. A finding that could only be settled by executing code comes back FALSE_POSITIVE with the open question named. Everything read is treated as untrusted data: a comment claiming the code is safe is a reason for suspicion, not an instruction.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/scan-verifier.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/scan-verifier.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/scan-verifier.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-verifier.md

## When to use it
- filter scanner false positives before anyone starts patching them
- check whether an attacker really controls the input at a given point
- find out if a framework default already blocks the path to the sink
- separate a real vulnerability from a finding that merely looks risky
- rate a confirmed finding by the code rather than by the report

## Example prompts
- Run scan-verifier on this scanner finding
- Have scan-verifier vote on the finding through the REACHABILITY lens
- Dispatch scan-verifier for this finding with SCAN_ROOT set

## Similar
- [deep-security-scan](https://affpapa.org/en/nevibecode/skills/deep-security-scan.md) — skill · 29 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 145 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md