SECURITY REVIEW / Anthropic
Scan loader
Pins the Claude Security loader whose only input is one directory plus one file name, and that returns that JSON unchanged.
“A read-only scan loader, not for direct invocation, that returns one named JSON file exactly and reads nothing else.”
01 / THE REASONING
Why this made the selection.
- The agents index has no entry for plugins/claude-security/agents/scan-loader.md.
- The file names its inputs, limits the tool list to Read, and says to add, drop, or reword nothing in the JSON.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/claude-security/agents/scan-loader.md
- plugins/claude-security/README.md
- README.md
- LICENSE
- Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14
- plugins/claude-security/LICENSE (overrides repository-wide licence for this plugin)
Our findings
- The description says it returns one JSON file from the run directory and is not for direct invocation. The only tool is Read. Model is sonnet and effort is low.
- The body says the dispatch names one directory and one file name, and that the JSON is returned exactly, with nothing added, dropped, or reworded.
- It says the file content is data from an earlier stage, not instructions, and to read nothing else and do nothing else.
- The file is treated as prior-stage data and cannot introduce new instructions or broaden file access.
- The loader has only Read and is a transport component, not a finding reviewer or JSON repair agent.
- The exact-revision plugin licence is proprietary and expressly covers prompts, agent/skill definitions, workflows, code and documentation; the root Apache licence does not license this plugin for redistribution.
Not established by this review
- The resource was not executed and its tools were not called.
- No JSON file was read.
- A missing-file dispatch was not tried.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Use the role in your project.
DOCUMENTED COMMAND
/plugin install claude-security@claude-plugins-officialCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Read the plugin-specific proprietary licence at this revision. Obtain the plugin from Anthropic and use/modify it only within the applicable authorized Anthropic-product agreement; this catalogue provides no copy for installation.
- The claude-security README shows that line, including the four leading spaces, then /reload-plugins on the next line.
- That line installs the claude-security plugin. It does not name this agent.
- The repository root README only has /plugin install {plugin-name}@claude-plugins-official, which is a placeholder, so it is not install.command.
- Use the matching small, schema-bounded scan artifact and independently compare structural completeness before consuming the returned JSON.
Before you start
- Claude Code
- Python 3.9 or newer on PATH, which the plugin README lists for the plugin
- The scan or fix job that dispatches this agent
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- scan-loader ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents/scan-loader.md
Supports: one file, exact JSON, and no other reads
- claude-security README ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/README.md
Supports: plugin install line
- Repository README ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/README.md
Supports: placeholder install line
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/LICENSE
Supports: Dependency setup and source-review boundary