A layered security-audit workflow for Claude Code: a deep LLM-driven repository audit, continuous guardrails during daily work, deterministic CLI scanners the LLM can't replace, and per-PR review — with the exact commands and the order to run them in.
Before I trust an AI agent with a codebase, how do I find what it — and everyone else — could break first?
No single tool is enough. Reasoning-based audits catch design and logic flaws that pattern scanners miss; deterministic scanners catch CVEs, leaked secrets across Git history, and misconfigurations an LLM will never enumerate reliably. This guide stacks both:
- Deep audit —
claude-security(official Anthropic plugin) for a thorough, verifier-checked pass over the whole repo. - Continuous guardrails —
security-guidanceand Semgrep Guardian, catching bad patterns as code is written. - Deterministic scanners — Gitleaks, OSV-Scanner, Trivy for secrets, dependencies, and IaC.
- Per-PR review —
/security-reviewand/code-review maxon every branch. - Specialized & offensive — Trail of Bits white-box skills, SecSkills methodology, and the
claude-pentestorchestrator, when you need to go past the baseline. Opt-in, with higher trust and risk than the four layers above.
Everything below runs inside Claude Code unless marked as a terminal command. Open the project root first.
Isolation warning. The audit plugins run with the same file and shell permissions as Claude Code, with no separate sandbox. Never point them at an untrusted or suspicious repository without a sandbox/container. This is repeated in context below — it's the one thing not to skip.
- Before you start
- 1. Deep repository audit with claude-security
- 2. Continuous guardrails
- 3. Deterministic scanners
- 4. Every PR and branch
- 5. Going deeper: specialized skill libraries
- Recommended sequence
- Recommended stack
- Related
- Further reading
- License
Start from a clean state so the report is tied to a specific revision and fixes are easy to review and roll back:
git status
git add .
git commit -m "checkpoint before security audit"claude-security is the official Anthropic plugin for a deep security audit of a repository. Open the project root in a terminal and start Claude Code:
cd C:\path\to\your\repo
claudeInside Claude Code:
/plugin marketplace add anthropics/claude-plugins-official
/plugin install claude-security@claude-plugins-official
/reload-plugins
/claude-security
Skip the marketplace add line if the official marketplace is already connected.
After /claude-security a menu appears:
- Scan codebase — full code audit.
- Choose Whole repository.
- Set the highest available effort — for a first audit prefer
exhaustive/max. - Let the scanner explore the repository, but don't let it change code automatically.
The plugin analyzes architecture, public entry points, authentication/authorization, injection, SSRF, file operations, data leaks, privilege escalation, and other vulnerability classes. On large projects it prioritizes attacker-reachable code first and usually skips generated/vendor files unless the most exhaustive mode is selected.
Results land in a directory like:
CLAUDE-SECURITY-2026.../
├── report.md
├── findings.jsonl
└── revision...
Each candidate issue is re-checked by independent verifier agents to cut down false positives.
To generate fixes, run the plugin again:
/claude-security
and choose:
Suggest patches
The plugin writes patch files but does not apply, commit, or push them on its own. That's the point — review each patch by hand before applying it.
- No isolation. The plugin works with the same file and shell permissions as Claude Code, without a separate sandbox. Don't run it on a suspicious or untrusted repository without a sandbox/container.
- Plugin/CLI compatibility (
v0.10.0). There are open reports that plugin version0.10.0is incompatible with some recent Claude Code versions: a scan may fail withWorkflow tool not available. If you see exactly that error, the problem is almost certainly CLI/plugin compatibility, not your repository — update Claude Code and reinstall/update the plugin first. - Resource usage — it is heavy. Scanning a single source folder is still a multi-agent run: up to ~14 subagents in parallel, each reading and grepping across the source. Expect 100% CPU and 20+ GB of memory while it runs; both drop the moment the panel finishes. Close other heavy work first, and don't launch it on a memory-constrained machine. The setup commands you'll see early on —
git ls-files,mkdir, andpython … write_scan_meta.py— are the scan sizing itself up (size gauge, report directory, revision stamp), not suspicious activity. - Python dependency (watch out on Windows). The scan's report scripts need Python. A
uv-managed interpreter is not onPATH—where python, thePATH, and the usual install directories will not find it, because uv keeps it outsidePATH; reach it withuv run pythonor locate it withuv python find. If you rely on auto-detection you may install a redundant second Python (e.g. viawinget) — harmless but unnecessary. Make sure a discoverable Python exists, or point the tool at the uv-managed one.
For continuous control rather than one big audit:
/plugin install security-guidance@claude-plugins-official
/reload-plugins
It works continuously:
- warns about insecure patterns during
EditandWrite; - reviews the diff after a task completes;
- can separately check a prospective commit.
So the ideal combination is:
claude-security— deep periodic audit;security-guidance— control during daily development.
For higher recall, enable two parallel LLM reviews.
PowerShell:
$env:SG_DUAL_OR = "on"
claudeBash:
export SG_DUAL_OR=on
claudeThis roughly doubles the cost of the check but can surface more issues. Add project-specific rules in .claude/claude-security-guidance.md.
The best additional automated layer. Install per Semgrep's current instructions:
/plugin marketplace add semgrep/guardian
/plugin install semgrep@semgrep-marketplace
/reload-plugins
Then ask:
Login to Semgrep
Guardian automatically checks files Claude creates through:
- Semgrep Code;
- Semgrep Supply Chain;
- Semgrep Secrets.
It uses deterministic rules and complements Claude's reasoning-based audit well.
Both are also present in the Claude Code ecosystem:
- Aikido — a single platform for SAST, secrets, and IaC;
- Endor Labs — more focused on dependency and software supply-chain risk.
They make sense for teams already using those cloud platforms. For a local or free workflow, Semgrep plus the CLI scanners below is usually simpler.
An LLM audit does not replace tools that exhaustively check the full Git history, lock files, CVE databases, and infrastructure configs. Don't skip these.
Secrets across the whole Git history:
gitleaks git -vChecks not only the current files but patches throughout Git history — an API key removed from the current version can still live in an old commit.
When it finds one, rotate — do not just rewrite history. A commit removed by force-push is unreachable, not deleted: on GitHub it stays retrievable by its SHA, and anyone who forked or cloned the repository still has a full copy. Any bot that indexed the push during the window has it too, and public repositories are scraped for credentials continuously.
So the only reliable order is: revoke the credential, issue a new one, then clean the history if you still want to. Cleaning first buys nothing and burns the time in which the key is still valid.
Vulnerable dependencies:
osv-scanner scan -r .Checks dependency manifests and lock files against the OSV database.
One comprehensive local sweep:
trivy fs --scanners vuln,misconfig,secret .Checks:
- dependencies and CVEs;
- secrets;
- Dockerfiles;
- Kubernetes;
- Terraform;
- other IaC/misconfiguration issues.
Claude Code ships this built in:
/security-review
It reviews the diff of the current branch against the default branch in origin — so a Git remote named origin must exist.
Broader than a plain security review:
/code-review max
Beyond security it can also find:
- logic errors;
- broken edge cases;
- concurrency problems;
- incorrect error handling;
- contract incompatibilities;
- potential regressions.
The four layers above are the baseline every repo should run. This layer is opt-in — reach for it when you need white-box depth past claude-security, offensive testing methodology, or a full black-box engagement. Trust required and blast radius both climb as you go down the list; read the warning that closes each one.
Trust escalates here.
claude-securityandsecurity-guidanceare official Anthropic plugins; Trail of Bits is a reputable security firm. SecSkills and claude-pentest are community-built — skim their skills and hooks before enabling, pin versions instead of trackinglatest, and never point the active ones at a repository or target you don't control. Third-party plugins can ship malicious hooks or backdoors; Trail of Bits themselves warn about this.
Trail of Bits maintains its own Claude Code marketplace of security-research and audit skills. It doesn't replace Burp or ZAP, but it sharpens the white-box side of an audit — the part claude-security starts and these skills take further.
/plugin marketplace add trailofbits/skills
/plugin install audit-context-building@trailofbits
/plugin install testing-handbook-skills@trailofbits
/plugin install fp-check@trailofbits
/plugin install static-analysis@trailofbits
/plugin install variant-analysis@trailofbits
/plugin install burpsuite-project-parser@trailofbits
/reload-plugins
What each one gives you:
| Skill | What it does |
|---|---|
audit-context-building |
Maps architecture and trust boundaries function by function before any bug hunting — the context step that makes every later finding sharper. |
testing-handbook-skills |
Fuzzing, sanitizers (ASan), coverage, and static-analysis setup drawn from the Trail of Bits Testing Handbook. |
fp-check |
Systematic false-positive verification — proves exploitability with a data-flow trace and PoC before a finding survives. Run it over claude-security output. |
static-analysis |
Drives CodeQL, Semgrep, and SARIF parsing — the interprocedural taint tracking a reasoning pass won't do reliably. |
variant-analysis |
After one bug is found, sweeps the whole codebase for the same pattern elsewhere. |
burpsuite-project-parser |
Searches and extracts data from saved Burp Suite project files. |
The marketplace holds ~40 more (c-review, rust-review, differential-review, supply-chain-risk-auditor, semgrep-rule-creator, insecure-defaults, and others) — browse them with /plugin.
Trail of Bits also runs a separate curated marketplace where plugins are manually vetted:
/plugin marketplace add trailofbits/skills-curated
/plugin install ffuf-web-fuzzing@skills-curated
Confirm exact marketplace names with /plugin menu if an install fails.
How it fits: run these alongside claude-security, not instead of it — audit-context-building before a deep scan, then fp-check and variant-analysis after: verify each survivor, then hunt its siblings.
SecSkills is a large library of security methodologies — not a scanner. It teaches Claude how to plan a check, verify real impact, and discard unconfirmed findings, routing the right discipline to the moment it applies. Around 90 skills across three plugins:
secskills-offense— web/API, Active Directory, Entra ID, cloud, Kubernetes, containers, mobile, wireless, privilege escalation, persistence.secskills-core— code audit, cryptography review, supply chain, binary/protocol analysis, AI/LLM and MCP security. Shared by both sides.secskills-defense— DFIR, malware analysis, detection authoring (Sigma/YARA), threat hunting.
For audit and pentest work, install offense + core:
/plugin marketplace add trilwu/secskills
/plugin install secskills-offense@secskills-marketplace
/plugin install secskills-core@secskills-marketplace
/reload-plugins
Blue-team/DFIR work wants secskills-defense@secskills-marketplace in place of offense.
Authorized use only. The offensive skills assume written permission, an in-scope bug bounty, or a lab/CTF target. You own the authorization.
The most complete ready-made pentest plugin — an agent-coordination framework, not a script or scanner. It ships 15 agents, 6 coordinator skills, and 63 attack categories across 11 domains, with Kali integration, a mandatory operator gate before active exploitation, PoC files, saved HTTP evidence, Playwright screenshots, and JSON + Markdown reports.
/plugin marketplace add Stickman230/claude-pentest
/plugin install pentest@claude-pentest
/reload-plugins
Define scope first, then launch:
/pentest:pentest-scope # target, out-of-scope, auth, time budget, thoroughness
/pentest:pentest-attacks # attack profile: Full / Web / API & Cloud / Custom
/pentest:pentest # launch — validates scope first
/pentest:pentest-exit # close, severity-bucketed summary, reset state
It runs: scope collection → pre-flight reachability → reconnaissance → planning → operator approval gate → executor deployment → time-budget escalation → report. A second gate sits inside each executor, between safe probes and active exploitation. Findings land under outputs/{engagement}/findings/ — each with a description.md (CVSS/CWE/impact), poc.py, proof output, and a screenshot.
Without a Kali box it uses local CLI tools. With one, connect a remote MCP-Kali-Server so it can orchestrate nmap, sqlmap, gobuster, Metasploit, hydra, john, and more:
/pentest:pentest-kali # enter server URL, verifies /health, saves .pentest-mks.json
With Kali active, post-exploitation (Metasploit) fires only on a confirmed CVE/RCE finding — never speculatively.
This is the highest-risk tool in this guide. Run it only:
- in a dedicated VM or devcontainer — never your host;
- against a staging or local target you own or are contracted to test;
- with explicit written authorization and a defined scope;
- without production credentials;
- confirming every active phase by hand.
It is community-built, holds broad shell and network access, and can drive a remote Kali host — its blast radius is far larger than a single Burp or ZAP action, and it inherits Claude Code's permissions with no separate sandbox. Don't make it the sole basis of an audit.
1. Make a clean checkpoint commit
2. gitleaks git -v
3. osv-scanner scan -r .
4. trivy fs --scanners vuln,misconfig,secret .
5. /claude-security → Scan codebase → Whole repository → max/exhaustive
6. Verify every finding directly in the code
7. /claude-security → Suggest patches
8. Apply patches one at a time, together with regression tests
9. /code-review max
10. /security-review
Going deeper (optional). For a specialist white-box pass, add the Trail of Bits skills to step 5–6: audit-context-building before the scan, fp-check and variant-analysis after. Offensive or black-box testing (SecSkills, claude-pentest) is a separate engagement — run it only under written authorization, on a staging target, inside a VM or devcontainer.
For the strongest result:
claude-security
+ security-guidance
+ Semgrep Guardian
+ Gitleaks
+ OSV-Scanner
+ Trivy
+ ordinary unit/integration security tests
Going deeper, add for a specialist white-box audit:
+ Trail of Bits: audit-context-building, fp-check, static-analysis, variant-analysis
+ SecSkills (secskills-core, secskills-offense) for methodology
Full offensive engagements (claude-pentest) stay isolated — separate VM, staging target, written scope — never bolted onto the daily stack.
Part of a set of agent guides — pick the layer you need:
- Awesome AGENTS.md — the base, tool-agnostic ruleset every agent imports (one
AGENTS.md). - Awesome Agent Skills — portable
SKILL.mdskills every agent loads: code review, debugging, security and leak audits, code and text cleanup. - Agent MCP Integrations — MCP servers that connect agents to browsers, cloud, databases, infra, and domain APIs.
- Claude Code Token Optimization — the token-efficiency layer (RTK, LSP, Context7,
codebase-memory-mcp, claude-mem, Caveman, Ponytail). - Claude Code Security Audit — this repo: the layered security-audit workflow.
- Claude Code documentation — slash commands, skills, plugins.
- anthropics/claude-plugins-official —
claude-security,security-guidance. - Semgrep — Guardian, Code, Supply Chain, Secrets.
- Gitleaks · OSV-Scanner · Trivy
- Trail of Bits skills · SecSkills · claude-pentest — specialized security skill libraries.
Released under the MIT license. The tools and plugins referenced here are third-party projects under their own licenses — check each before use.