Security Guidance

security-guidance

Security review for Claude-generated code. Three layers:

1. Pattern warnings — instant regex-based reminders on Edit/Write for ~25 known-dangerous patterns (yaml.load, torch.load(weights_only=False), pickle.load on untrusted data, raw innerHTML, hardcoded secrets, etc.).
2. LLM diff review — when Claude finishes a turn, the plugin sends the diff to a fast LLM call (high-capability model by default) and feeds high-severity findings back to Claude so it can fix them before you see the response.
3. Agentic commit review — on git commit, an SDK-driven reviewer reads related files (Read/Grep/Glob) to trace data flow across the codebase, catching multi-file vulnerabilities pattern matching misses (IDOR, auth bypass, cross-file SSRF).

Findings cover common web-vulnerability classes — injection, XSS, SSRF, hardcoded secrets, IDOR, auth bypass, unsafe deserialization, and path traversal among others.

Install

/plugin install security-guidance@claude-plugins-official

Marketplace ships enabled by default in coding assistant — no setup beyond having the CLI itself.