SECURITY REVIEW / Anthropic
Scan verifier
Pins the Claude Security voter that takes one candidate finding and tries to disprove it, with a false-positive default and a file-and-line citation rule.
“A scan-workflow verifier, not for direct invocation, that votes on one finding and treats an untraced or merely risky claim as a false positive.”
01 / THE REASONING
Why this made the selection.
- The agents index has no repository and sourcePath entry for plugins/claude-security/agents/scan-verifier.md.
- The file requires one dispatched finding, says it is not for direct invocation, and withholds TRUE_POSITIVE unless the source, the operation, and the missing mitigation are each cited at a file and line.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/claude-security/agents/scan-verifier.md
- plugins/claude-security/README.md
- README.md
- LICENSE
- Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14
- plugins/claude-security/LICENSE (overrides repository-wide licence for this plugin)
Our findings
- The description says it is a restricted read-only verifier dispatched by the scan workflow to vote on one candidate finding, and that it is not for direct invocation.
- The body says to default to FALSE_POSITIVE, and to rule TRUE_POSITIVE only for a concrete path with a file and line for the attacker-controlled source, the dangerous operation, and no effective mitigation.
- Tools are Read, Glob, Grep, Bash, and Agent(claude-security:explore). The body limits Bash to searching, reading, and read-only git, and says that limit is not an enforced wall.
- It says to return the structured object the dispatch asks for, with reasoning that names the decisive file:line, and that the panel's arithmetic is done outside the model.
- PREDATES_CHANGE means the flaw is real but untouched by this diff; it is neither confirmation of a new regression nor denial of the underlying flaw.
- A new route to an old sink can still implicate the change, so matching old sink text alone is insufficient.
- The exact-revision plugin licence is proprietary and expressly covers prompts, agent/skill definitions, workflows, code and documentation; the root Apache licence does not license this plugin for redistribution.
Not established by this review
- The resource was not executed and its tools were not called.
- No candidate finding was supplied.
- The explore subagent named in the tool list was not dispatched.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Use the role in your project.
DOCUMENTED COMMAND
/plugin install claude-security@claude-plugins-officialCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Read the plugin-specific proprietary licence at this revision. Obtain the plugin from Anthropic and use/modify it only within the applicable authorized Anthropic-product agreement; this catalogue provides no copy for installation.
- The claude-security README shows that line, including the four leading spaces, then /reload-plugins on the next line.
- That line installs the claude-security plugin. It does not name this agent.
- The repository root README only has /plugin install {plugin-name}@claude-plugins-official, which is a placeholder, so it is not install.command.
- Use the matching scan dispatcher and retain the vote reasoning and independent panel arithmetic; enforce read-only access outside the prompt.
Before you start
- Claude Code
- Python 3.9 or newer on PATH, which the plugin README lists for the plugin
- The scan or fix job that dispatches this agent
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- scan-verifier ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents/scan-verifier.md
Supports: one finding, false-positive default, and read-only Bash rule
- claude-security README ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/README.md
Supports: verbatim plugin install line and Claude Code requirement
- Repository README ↗Checked
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/README.md
Supports: placeholder install line
https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/LICENSE
Supports: Dependency setup and source-review boundary