anthropics/security-guidance
claude-codeOfficial# security-guidance Security review for Claude-generated code. Three layers: 1. **Pattern warnings** — instant regex-based reminders on `Edit`/`Write` for ~25 known-dangerous patterns (`yaml.load`, `torch.load(weights_only=False)`, `pickle.load` on untrusted data, raw `innerHTML`, hardcoded secrets, etc.). 2. **LLM diff review** — when Claude finishes a turn, the plugin sends the diff to a fast LLM call (Opus 4.7 by default) and feeds high-severity findings back to Claude so it can fix them be
Our Verdict
Security reminder hook that warns about potential security issues like command injection, XSS, and unsafe code patterns when editing files. Best for developers integrating security into daily coding workflows. Provides real-time edit warnings unlike static linters or scanners.
Frequently Asked Questions
What is anthropics/security-guidance used for?
Anthropics/security-guidance is a security reminder hook that flags potential issues such as command injection, XSS, and unsafe code patterns during file edits. It promotes secure coding by providing immediate warnings to developers.
What is security-guidance?
# security-guidance Security review for Claude-generated code. Three layers: 1. **Pattern warnings** — instant regex-based reminders on `Edit`/`Write` for ~25 known-dangerous patterns (`yaml.load`, `torch.load(weights_only=False)`, `pickle.load` on untrusted data, raw `innerHTML`, hardcoded secrets, etc.). 2. **LLM diff review** — when Claude finishes a turn, the plugin sends the diff to a fast LLM call (Opus 4.7 by default) and feeds high-severity findings back to Claude so it can fix them be
How do I install security-guidance?
Visit the GitHub repository at https://github.com/anthropics/claude-plugins-official/tree/main/plugins/security-guidance for installation instructions.
What license does security-guidance use?
security-guidance uses the Proprietary license.
What are alternatives to security-guidance?
Explore related tools and alternatives on My AI Guide.
Open source: source code publicly visible
Anyone can inspect exactly what this repo does on GitHub before using it. Proprietary licensed.
Reviewed by My AI Guide for relevance, quality, and active maintenance before listing.
Install in Claude Code:
/install security-guidance