# agentic-security

A Claude plugin that hunts for vulnerabilities, tests whether each finding is actually exploitable, and repairs it through a verification gate. Useful when a model wrote the code and you need to know what is unsafe.

- plugin · `type=plugin` · Claude Code · ★ 118
- Author: Clear-Capabilities
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Clear-Capabilities/agentic-security
- Updated: 2026-10-20
- HTML: https://affpapa.org/en/nevibecode/plugins/agentic-security

## What it does

Mechanical analyzers do the scanning, and agents do the reasoning: some look for weaknesses, others try to knock each finding down. A claim only stands when tooling backs it, not when a model says so. The model cannot set severity, confirm an exploit or mark a fix verified.

Repairs go through a gate. Before anything lands in your files, the patch is scanned again and run past the linter and the test suite. The report lists which checks ran and which did not. Start with `npx @clear-capabilities/agentic-security-scanner ci examples/demo-app --assurance strict` — `--assurance` belongs to `ci` only, there is no `scan --assurance`. In `strict` mode the build fails when the analysis itself did not finish cleanly, not just when vulnerabilities turn up.

A scan that stopped early is never reported as clean. A missing analyzer, a skipped validation step, a partial run: none of these count as proof that code is safe. Accuracy on outside code was measured once and came out low — precision 6/19, recall 6/278, F1 0.040. Keep that in mind before you lean on a report.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-community
```
In the agent chat (not a shell):
```text
/plugin install agentic-security@claude-community
```

## When to use it
- find vulnerabilities in model-generated code
- cut scanner false positives by trying to disprove each finding
- show what a flaw can reach in the codebase
- fix a vulnerability and confirm the patch did not break anything
- avoid mistaking an unfinished scan for a clean one

## Example prompts
- Scan the demo app: `npx @clear-capabilities/agentic-security-scanner ci examples/demo-app --assurance strict`
- Check this repo for vulnerabilities and show me which ones are actually exploitable
- Find the issue, propose a patch, and run the checks before writing it

## Similar
- [security-guidance](https://affpapa.org/en/nevibecode/plugins/security-guidance.md) — plugin · ★ 44635
- [mcp-tunnels](https://affpapa.org/en/nevibecode/plugins/mcp-tunnels.md) — plugin · ★ 44635
- [hookify](https://affpapa.org/en/nevibecode/plugins/hookify.md) — plugin · ★ 44635
- [code-modernization](https://affpapa.org/en/nevibecode/plugins/code-modernization.md) — plugin · ★ 44635
- [claude-security](https://affpapa.org/en/nevibecode/plugins/claude-security.md) — plugin · ★ 44635
- [google-cloud-developer](https://affpapa.org/en/nevibecode/plugins/google-cloud-developer.md) — plugin · ★ 21578

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md