Security guidance plugin

The security-guidance plugin turns Claude into its own first security reviewer. As Claude edits files, finishes a turn, or commits, the plugin checks the change for common vulnerability classes (injection, unsafe deserialisation, dangerous DOM APIs, auth gaps and more) and feeds anything it finds back to Claude, which fixes it in the same session.

There is nothing to run once it is installed. It works in the background on every change Claude makes.

Think of it as the early layer. Code Review catches problems on the pull request; this plugin means fewer of them get that far.

Before you install

• Python 3.7+ on your PATH. The deeper commit review needs 3.10+, and so do all model-backed reviews if you use a third-party provider such as Bedrock or Google Cloud's Agent Platform. The plugin tries python3.13 down to python3.10, then python3, python and py -3.
• A git repository. End-of-turn and commit reviews diff against git and quietly skip outside one. The per-edit check works anywhere.

On first run the plugin builds a virtual environment in ~/.claude/security/ and installs the Claude Agent SDK into it, so it needs pip and network access. If that fails, or Python is older than 3.10, the commit review falls back to a single-shot review on first-party auth. On a third-party provider the model-backed reviews need the SDK, so they skip. You get a one-time notice if old Python is the reason.

Installing

From a terminal session, using the official Anthropic marketplace:

/plugin install security-guidance@claude-plugins-official

Pick user scope when asked, so it loads in every local session on the machine.

If /plugin is not available where you are:

• Desktop app (local or SSH): + next to the prompt, then Plugins, then Add plugin.
• VS Code: the Manage plugins dialog. See VS Code.
• Cloud sessions: these do not load plugins from user settings or from the repo's .claude/settings.json. Organisation-distributed plugins are covered in managing plugins for your organisation.

If the install fails:

• Marketplace "claude-plugins-official" not found: run /plugin marketplace add anthropics/claude-plugins-official and retry.
• Plugin not found in the marketplace: check the spelling.

If the summary says Run /reload-plugins to apply., do that to activate it without restarting. See the plugin CLI reference.

Turning it on for the whole team

Commit this to the repository so teammates' local sessions pick it up:

{
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true
  }
}

That goes in .claude/settings.json. Admins can enforce it everywhere by setting enabledPlugins in managed settings.

The three checkpoints

Per-edit pattern check

After Claude writes a file, the plugin scans the content for known-risky constructs and appends a warning to Claude's context for its next step. Because it is pure string matching, it costs nothing. Examples of what it flags:

• dynamic execution: eval(, new Function, os.system, child_process.exec;
• deserialisation: pickle;
• DOM injection: dangerouslySetInnerHTML, .innerHTML =, document.write;
• anything under .github/workflows/, since workflow files can grant repository-wide permissions.

Each warning fires once per pattern, per file, per session, so it will not spam the conversation.

End-of-turn review

A turn is one exchange: you send a message, Claude works and replies. Afterwards the plugin diffs the working tree against where it was when you sent the message, capturing everything (edit tools, Bash commands, subagents), and sends that diff to a separate security-focused Claude call. It runs in the background so Claude's reply is not delayed. If it finds something, Claude is re-prompted with the findings and deals with them.

This is where it catches things a regex cannot: authorisation bypass, insecure direct object references, injection, SSRF, weak cryptography. Limits: up to 30 changed files per turn, and no more than three consecutive re-prompts before control returns to you.

Commit and push review

When Claude runs git commit or git push through its Bash tool, a deeper agentic review reads around the change (callers, sanitisers, related files) to decide whether a suspicious pattern is actually exploitable in your code. That context is what keeps false positives down.

• Only commits and pushes Claude makes are reviewed. Your own commits, including via ! in a session, are not.
• Capped at 20 reviews per rolling hour.
• If its findings duplicate the end-of-turn review, Claude is not re-prompted, so a clean commit produces no output.

Independence and limits

The code author is not marking its own homework. The edit check has no model at all, and the other two reviews are separate Claude calls with a fresh context and a prompt that only looks for problems.

None of the layers block anything. Findings go to Claude as instructions, and the reviewer can miss things. Treat the plugin as one layer of defence in depth.

Adding your own rules

Two extension points, both additive: you can add checks, never switch built-in ones off.

Guidance for the model reviews

Write your threat model in plain English in .claude/claude-security-guidance.md. The model-backed reviews read it alongside their built-in checklist. For a multi-tenant SaaS API, mine looks like this:

# Security notes for this service

- Every query on tenant data must be scoped by `organisation_id` from the session, never from the request body.
- Webhook handlers must verify the provider signature before parsing the payload.
- Never return stack traces in HTTP responses outside the `development` environment.
- Signed URLs for file downloads must expire in 15 minutes or less.

These are hints to the reviewer, not hard guarantees, and an instruction to ignore a vulnerability class will not suppress it. For enforcement, add a hook that blocks the edit or a CI check.

Extra per-edit patterns

Add regex or substring rules in .claude/security-patterns.yaml:

patterns:
  - rule_name: raw_sql_string_format
    regex: "execute\\(f[\"']"
    paths: ["**/app/**/*.py"]
    reminder: "f-string inside execute(). Use parameterised queries."
  - rule_name: stripe_secret_key
    substrings: ["sk_live_", "rk_live_"]
    exclude_paths: ["**/docs/**"]
    reminder: "Live Stripe key in source. Read it from the secrets manager."

.claude/security-patterns.yml and .claude/security-patterns.json are also read with the same schema. YAML needs PyYAML importable, which the plugin does not install; JSON always works. At most 50 custom rules load, and regexes that look prone to catastrophic backtracking are skipped.

Where rule files are found

Both files are looked up in three places, all of which are loaded and concatenated if present:

The combined guidance is capped at 8 KB. security-patterns.yaml uses the same three locations. Admins can push a user-scope file to ~/.claude/ through device management to roll out organisation-wide rules.

Cost

• The per-edit check is free.
• The end-of-turn and commit reviews use model usage like any other request; the commit review is agentic and may take several turns. Roughly: one review per turn that changes files, one deeper review per commit, within the caps above. See costs.
• Both use Claude Opus 4.7 by default. Override with SECURITY_REVIEW_MODEL (end-of-turn) and SG_AGENTIC_MODEL (commit).

The plugin is available on every plan.

Turning parts off

Or use the plugin commands:

/plugin disable security-guidance@claude-plugins-official
/plugin uninstall security-guidance@claude-plugins-official

If the plugin came from a project's .claude/settings.json, uninstalling via /plugin writes an override to your .claude/settings.local.json so only you are affected; the same dialog offers to remove it for everyone. If it came from managed settings, only an admin can turn it off.

Under the bonnet

The plugin is built purely from hooks:

The plugin's source in the anthropics/claude-plugins-official repository on GitHub is a good example of calling a separate model from a hook and feeding the result back into the session.

Where it fits

For code that already exists rather than what Claude is writing, ask Claude to review specific files, or run Claude Security across the repository. /security-review only looks at your branch's changes. All of these read source in your checkout, not a running service.

Troubleshooting

Start with ~/.claude/security/log.txt. Reviews skip silently when:

• the folder is not a git repo (end-of-turn and commit reviews need one);
• there is no Anthropic authentication and no third-party provider configured (only the pattern check runs);
• a YAML patterns file exists but PyYAML is missing (it is ignored; switch to JSON).

Related

• Claude Security
• Code Review
• Hooks guide
• Official plugin marketplaces
• Security