All skills & plugins / Claude Code official plugins

security-guidance

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

Pre-approved tools

No allowed-tools or tools list in its SKILL.md, command or agent files, so the agent asks before using tools as usual.

Hooks

Hooks run automatically on these agent events, without you invoking the skill: PostToolUse, SessionStart, Stop, UserPromptSubmit.

MCP servers and apps

None.

Bundled code

57 code files (Python, Shell); first 40 listed:

• security-guidance/tests/test_temp_index_cleanup.py
• security-guidance/tests/test_nested_repos.py
• security-guidance/tests/test_prompt_cache.py
• security-guidance/tests/test_inflight_reviews.py
• security-guidance/tests/test_review_model.py
• security-guidance/tests/test_stop_review_paths.py
• security-guidance/tests/test_launcher_process_count.py
• security-guidance/tests/test_git_index_locks.py
• security-guidance/tests/test_reviewer_tools.py
• security-guidance/tests/test_review_outcomes.py
• security-guidance/tests/test_sdk_emptied_install.py
• security-guidance/tests/test_stop_baseline_checkout.py
• security-guidance/tests/test_untracked_cap.py
• security-guidance/tests/test_diff_parsing.py
• security-guidance/tests/test_reviewer_context_metrics.py
• and 42 more

Network calls

4 files with a network call pattern. First match per file:

• plugins/security-guidance/tests/test_network_failure_class.py:4

  import http.client

• plugins/security-guidance/tests/test_tls_store_unreadable_cert.py:14

  import urllib.request

• plugins/security-guidance/hooks/security_reminder_hook.py:71

  import urllib.request

• plugins/security-guidance/hooks/llm.py:32

  import urllib.request

Starts other programs

33 files. First match per file:

• plugins/security-guidance/tests/test_temp_index_cleanup.py:174

  p = subprocess.Popen([sys.executable, "-c", "pass"])

• plugins/security-guidance/tests/test_nested_repos.py:113

  listed = subprocess.run(

• plugins/security-guidance/tests/test_inflight_reviews.py:35

  p = subprocess.Popen(

• plugins/security-guidance/tests/test_stop_review_paths.py:62

  where subprocess.run and the bounded diff reader both start theirs."""

• plugins/security-guidance/tests/test_launcher_process_count.py:33

  BASH_MAJOR = int(subprocess.run([BASH, "-c", "echo ${BASH_VERSINFO[0]}"], capture_output=True,

Credentials referenced

ANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENDB_PASSWORDSECRETSECRET_KEYSESSION_SECRET

Static scan of commit 41f619d on 2026-10-27. Signals are patterns found in the files, not a verdict: a network call can be the whole point of a skill. Read the linked lines before you decide. How the scan works.