--- title: "Scan verifier: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/anthropic-scan-verifier/ description: "Pins the Claude Security voter that takes one candidate finding and tries to disprove it, with a false-positive default and a file-and-line citation rule." --- # Scan verifier: review, role & definition · Undominated.ai > Pins the Claude Security voter that takes one candidate finding and tries to disprove it, with a false-positive default and a file-and-line citation rule. [← Explore all agents](/agents/) SECURITY REVIEW / Anthropic # Scan verifier Pins the Claude Security voter that takes one candidate finding and tries to disprove it, with a false-positive default and a file-and-line citation rule. [Use this definition ↓](#setup)[Original source ↗](https://github.com/anthropics/claude-plugins-official/tree/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Anthropic Licence [Proprietary — Anthropic internal-use terms ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/LICENSE) Revision 41f32e407b45 [Read what was—and wasn’t—checked ↓](#review) “A scan-workflow verifier, not for direct invocation, that votes on one finding and treats an untraced or merely risky claim as a false positive.” [Anthropic · upstream description ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents/scan-verifier.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The agents index has no repository and sourcePath entry for plugins/claude-security/agents/scan-verifier.md. - The file requires one dispatched finding, says it is not for direct invocation, and withholds TRUE_POSITIVE unless the source, the operation, and the missing mitigation are each cited at a file and line. ### A good fit for - A second look at one Claude Security candidate finding when the host already has the scan workflow's dispatch - Supply a single candidate, absolute scan root and one refutation lens. - Return a structured vote with decisive file/line evidence and supported severity. ### Weigh up before choosing - This review did not execute the resource. - A Markdown profile does not register a native subagent by itself. - The install line installs the claude-security plugin, which ships this agent with the rest of that plugin, not this file alone. - Frontmatter includes Bash. The file says the read-only limit is a rule to follow, not a wall that stops other commands. - The CRITICAL, HIGH, MEDIUM, and LOW labels are the file's own scale. This review did not apply them to a finding. - An unresolved execution-dependent case is labeled FALSE_POSITIVE by this workflow; users must retain the stated uncertainty rather than interpreting that label as proved safety. Bash restrictions are prompt rules. - The plugin-specific licence limits use and modification to authorized internal use with Anthropic products/services. General redistribution and non-Anthropic use are not permitted; obtain and use it through the publisher under the applicable agreement. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/claude-security/agents/scan-verifier.md - plugins/claude-security/README.md - README.md - LICENSE - Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14 - plugins/claude-security/LICENSE (overrides repository-wide licence for this plugin) ### Our findings - The description says it is a restricted read-only verifier dispatched by the scan workflow to vote on one candidate finding, and that it is not for direct invocation. - The body says to default to FALSE_POSITIVE, and to rule TRUE_POSITIVE only for a concrete path with a file and line for the attacker-controlled source, the dangerous operation, and no effective mitigation. - Tools are Read, Glob, Grep, Bash, and Agent(claude-security:explore). The body limits Bash to searching, reading, and read-only git, and says that limit is not an enforced wall. - It says to return the structured object the dispatch asks for, with reasoning that names the decisive file:line, and that the panel's arithmetic is done outside the model. - PREDATES_CHANGE means the flaw is real but untouched by this diff; it is neither confirmation of a new regression nor denial of the underlying flaw. - A new route to an old sink can still implicate the change, so matching old sink text alone is insufficient. - The exact-revision plugin licence is proprietary and expressly covers prompts, agent/skill definitions, workflows, code and documentation; the root Apache licence does not license this plugin for redistribution. ### Not established by this review - The resource was not executed and its tools were not called. - No candidate finding was supplied. - The explore subagent named in the tool list was not dispatched. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/README.md) DOCUMENTED COMMAND /plugin install claude-security@claude-plugins-official Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Read the plugin-specific proprietary licence at this revision. Obtain the plugin from Anthropic and use/modify it only within the applicable authorized Anthropic-product agreement; this catalogue provides no copy for installation. - The claude-security README shows that line, including the four leading spaces, then /reload-plugins on the next line. - That line installs the claude-security plugin. It does not name this agent. - The repository root README only has /plugin install {plugin-name}@claude-plugins-official, which is a placeholder, so it is not install.command. - Use the matching scan dispatcher and retain the vote reasoning and independent panel arithmetic; enforce read-only access outside the prompt. ### Before you start - Claude Code - Python 3.9 or newer on PATH, which the plugin README lists for the plugin - The scan or fix job that dispatches this agent ### Compatibility Claude Code ### Read-only verifier for one dispatched finding - Read files under the SCAN_ROOT the dispatch names - Use Bash only for the read-only commands the file lists, if the host honors that tool - Return a vote; the file does not grant a patch, merge, or push ### Cost model Proprietary plugin for authorized internal use solely with Claude Code or other Anthropic products/services under the applicable Anthropic agreement. Host/model charges may apply; no general redistribution licence. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [scan-verifier ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents/scan-verifier.md) Checked 2026-10-14 https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/agents/scan-verifier.md Supports: one finding, false-positive default, and read-only Bash rule - [claude-security README ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/README.md) Checked 2026-10-14 https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/README.md Supports: verbatim plugin install line and Claude Code requirement - [Repository README ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/README.md) Checked 2026-10-14 https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/README.md Supports: placeholder install line - [Controlling Claude Security plugin licence ↗](https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/LICENSE) Checked 2026-10-14 https://github.com/anthropics/claude-plugins-official/blob/41f32e407b450055044f167db7ded5e8ff67d203/plugins/claude-security/LICENSE Supports: Dependency setup and source-review boundary KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Scan inventory ↗ Pins the Claude Security cartographer that partitions one tree and must place every listed top-level directory on a scanned or skipped ledger.](/agents/anthropic-scan-inventory/)[### Scan loader ↗ Pins the Claude Security loader whose only input is one directory plus one file name, and that returns that JSON unchanged.](/agents/anthropic-scan-loader/)[### Exploitability verifier ↗ Pins the fp-check phase-2 agent that stays read-only while deciding whether a suspected bug is exploitable, and that skips a proof the bug class does not need.](/agents/trailofbits-exploitability-verifier/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)