Install This Open-Source Plugin for 13 Deterministic Security Workflows in

Security reviews with AI coding agents have always had a trust problem: "Did the model actually check everything, or did it hallucinate a finding?" The new code-security-skills plugin for Claude Code solves this by packaging 13 evidence-driven workflows that produce deterministic, verifiable artifacts.

What Changed

Developer barvhaim released code-security-skills, an open-source Claude Code plugin that delivers 13 security workflows for threat modeling, code review, finding validation, attack-path analysis, remediation, tracking, and deterministic security reporting.

Key design decisions:

• Provider-neutral: Workflows describe required capabilities (file access, search, shell) rather than assuming a specific model
• Deterministic output: Every scan produces scan-manifest.json, findings.json, coverage.json, report.md, and exports/results.sarif
• No file modification: By default, scans are read-only and write artifacts outside the target repository
• Independent skills: Claude Code discovers each of the 13 workflows independently under the code-security-skills namespace

What It Means For You

If you've ever wondered whether Claude Code caught all the vulnerabilities in a PR diff, this plugin gives you a structured answer. Instead of a free-form "here's what I found" response, you get:

1. A manifest that proves the scan ran against a specific commit/branch
2. Structured findings with confidence levels, severity, and remediation steps
3. Coverage data showing what was reviewed and what was excluded
4. SARIF export for integration with GitHub Code Scanning, VS Code, or other tooling

This is especially valuable for teams that need to demonstrate security due diligence—whether for compliance, audits, or internal gating before merge.

Try It Now

Installation is a single command:

claude /plugin marketplace add barvhaim/code-security-skills
claude /plugin install code-security-skills@code-security
claude /reload-plugins

Then run a scan on your current changes:

claude /code-security-skills:security-diff-scan Review the current working tree for security regressions. Do not modify files.

Or scan the entire repository:

claude /code-security-skills:security-scan Scan this repository. Do not modify source files.

By default, scan artifacts are written to code-security-scans/<repository>/ under the system temporary directory. You can specify a different output path in the prompt.

When To Use It

• Before every PR merge: Run /code-security-skills:security-diff-scan to catch regressions
• Onboarding new dependencies: Scan the repo after adding a new package
• Compliance audits: Generate deterministic SARIF reports for your security team
• CI/CD integration: The deterministic output format makes it easy to parse results in a pipeline

The Bottom Line

This plugin transforms Claude Code from a helpful code reviewer into a reproducible security auditing tool. The provider-neutral design means the same workflows could work with other coding agents—but right now, Claude Code's plugin system makes it trivially easy to install and run.

For teams shipping security-critical code, this is the kind of tool that turns "I think Claude checked everything" into "here's the manifest proving it did."

Source: github.com