Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.
by wshobson· SecurityUnclaimed · Yours? Claim it
4 images
About
Security Scanning is a plugin from Seth Hobson's agents collection (wshobson/agents), a community project. It gives your coding agent two security subagents, three commands and five threat-modeling skills: static analysis of your code, dependency scanning, a step-by-step hardening workflow and STRIDE-style threat modeling. What's inside - security-auditor (agent): DevSecOps, OWASP, authentication (OAuth2/OIDC), cloud security, compliance frameworks such as GDPR, HIPAA and SOC 2, and incident response - threat-modeling-expert (agent): STRIDE, PASTA, attack trees, data flow diagrams, risk scoring and mitigation design - /security-scanning:security-sast: static analysis for Python, JavaScript/TypeScript, Java, Ruby, PHP, Go and Rust with tools such as Bandit, Semgrep, ESLint Security, SonarQube and CodeQL, looking for SQL injection, XSS, hardcoded secrets, path traversal, insecure deserialization and more - /security-scanning:security-dependencies: scans your dependencies across ecosystems for known vulnerabilities, outdated packages and license issues, prioritizes fixes and produces an SBOM - /security-scanning:security-hardening: a 13-step hardening workflow in four phases (assessment and threat modeling, remediation, security controls, validation and compliance). It stops for your approval between phases and saves its work in .security-hardening/ - Skills: attack-tree-construction, sast-configuration (setting up Semgrep, SonarQube and CodeQL), security-requirement-extraction, stride-analysis-patterns and threat-mitigation-mapping How to install In Claude Code, run /plugin marketplace add wshobson/agents, then /plugin install security-scanning@claude-code-workflows. Codex CLI uses codex plugin marketplace add wshobson/agents. The repository also has install routes for Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi. Good to know - It's a community plugin, not a security vendor's product. - The scans use open-source scanners such as Bandit, Semgrep and ESLint Security in your project; the commands show how to install them. - The hardening workflow can take --depth quick, standard or comprehensive, and --compliance with frameworks such as owasp, soc2, gdpr, hipaa or pci-dss.
Once it’s added
“Run a static security scan of this repo and list the findings by severity.”
“Scan our dependencies for known vulnerabilities and generate an SBOM.”
“Perform a security audit and implement OWASP best practices.”
“Run a STRIDE threat model for our payment API.”
“Build an attack tree for account takeover of our admin panel.”
“Set up Semgrep and CodeQL scanning in our GitHub Actions pipeline.”
Before you add it
Reads only
Your source code, dependency manifests and architecture · Scanner output from tools such as Bandit, Semgrep and CodeQL
Makes changes · your agent can ask first
Security fixes and hardening changes in your code, with your approval between phases · Threat models, attack trees, SBOMs and CI scanning config · Workflow notes in .security-hardening/
Each with its own page
From people who use it
Step by step
Nothing new reaches your agent until a person has looked at it.
No reviews yet. Used Security Scanning? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
/plugin marketplace add wshobson/agents /plugin install security-scanning@claude-code-workflows
Scanned and passed · checked 6 h ago
Plugins people install alongside Security Scanning.
Scanned on every change, and again when our rules improve.
Claude CodeSupported
OpenClawSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Nobody has shared how they use Security Scanning yet.
Security scan
Passed
Safe to install in every agent it supports. Claude plugins.
Plugins people install alongside Security Scanning.
Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.
Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.
Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.
CrowdStrike's local MCP server for Falcon: your agent triages detections, looks up hosts and threat intel, and runs Next-Gen SIEM searches.
