# Security Scanning

> Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.

Security Scanning is a plugin from Seth Hobson's agents collection (wshobson/agents), a community project. It gives your coding agent two security subagents, three commands and five threat-modeling skills: static analysis of your code, dependency scanning, a step-by-step hardening workflow and STRIDE-style threat modeling.

What's inside
- security-auditor (agent): DevSecOps, OWASP, authentication (OAuth2/OIDC), cloud security, compliance frameworks such as GDPR, HIPAA and SOC 2, and incident response
- threat-modeling-expert (agent): STRIDE, PASTA, attack trees, data flow diagrams, risk scoring and mitigation design
- /security-scanning:security-sast: static analysis for Python, JavaScript/TypeScript, Java, Ruby, PHP, Go and Rust with tools such as Bandit, Semgrep, ESLint Security, SonarQube and CodeQL, looking for SQL injection, XSS, hardcoded secrets, path traversal, insecure deserialization and more
- /security-scanning:security-dependencies: scans your dependencies across ecosystems for known vulnerabilities, outdated packages and license issues, prioritizes fixes and produces an SBOM
- /security-scanning:security-hardening: a 13-step hardening workflow in four phases (assessment and threat modeling, remediation, security controls, validation and compliance). It stops for your approval between phases and saves its work in .security-hardening/
- Skills: attack-tree-construction, sast-configuration (setting up Semgrep, SonarQube and CodeQL), security-requirement-extraction, stride-analysis-patterns and threat-mitigation-mapping

How to install
In Claude Code, run /plugin marketplace add wshobson/agents, then /plugin install security-scanning@claude-code-workflows. Codex CLI uses codex plugin marketplace add wshobson/agents. The repository also has install routes for Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi.

Good to know
- It's a community plugin, not a security vendor's product.
- The scans use open-source scanners such as Bandit, Semgrep and ESLint Security in your project; the commands show how to install them.
- The hardening workflow can take --depth quick, standard or comprehensive, and --compliance with frameworks such as owasp, soc2, gdpr, hipaa or pci-dss.

- Type: Plugin
- Made by: wshobson
- Category: Security
- Formats: Claude plugins
- Version: 1.3.2
- Website: https://github.com/wshobson/agents
- Source: https://github.com/wshobson/agents/tree/HEAD/plugins/security-scanning
- Page: https://pluginboard.ai/plugins/security-scanning

## Works with

- Claude
- GitHub Copilot
- Claude Code
- OpenClaw

## Install

### Claude

In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter wshobson/agents, then add security-scanning

### Claude Code

In Claude Code:

```text
/plugin marketplace add wshobson/agents
/plugin install security-scanning@claude-code-workflows
```

---
From Pluginboard (https://pluginboard.ai).