Security Guidance Plugin: Security Review for Claude Code
security-guidance reviews Claude-generated code in three layers: pattern warnings on edits, an LLM diff review on Stop and an agentic review on git commit.
By Claudekit Team Published 1 min read
- Type
- Plugin
- Pricing
- Open Source
- Repository
- github.com
- Website
- github.com
security-guidance is an Anthropic plugin that reviews code Claude writes for security problems. It combines instant pattern warnings on edits, an LLM review of the diff when Claude finishes a turn, and an agentic reviewer that traces data flow across files when you commit.
Checked 24 Oct 2026 against the plugin’s README and marketplace.json (version 2.0.16).
Who it is for
Teams that let Claude write production code and want a security check built into the loop, not only at PR time.
Install
/plugin install security-guidance@claude-plugins-officialYou need Claude Code v2.1.144 or later and Python 3.8+ on your PATH.
What it does
- Pattern warnings: regex reminders on
EditandWritefor about 25 dangerous patterns, such asyaml.load,pickle.loadon untrusted data, rawinnerHTMLand hardcoded secrets. - LLM diff review: on Stop, sends the diff to the newest Opus and feeds high-severity findings back to Claude before you see the reply.
- Agentic commit review: on
git commit, an SDK-driven reviewer reads related files to catch multi-file issues like IDOR, auth bypass and cross-file SSRF.
Each layer can be switched off with environment variables such as ENABLE_STOP_REVIEW=0 or ENABLE_COMMIT_REVIEW=0.
Pros
- Catches problems while Claude can still fix them in the same session.
- Org rules in
claude-security-guidance.mdcover what a model cannot infer. - Clear privacy section explaining what is sent and where.
Cons and caveats
- LLM reviews add token cost;
SG_DUAL_OR=onroughly doubles it for higher recall. - Diffs and related files are sent to your model endpoint.
- The README calls it best-effort: not a substitute for human review, SAST, dependency scanning or pen-testing.
Links
- Plugin folder: plugins/security-guidance
- Related: Trail of Bits skills, hooks guide, Hookify
Frequently asked questions
Does it cost extra?
The pattern warnings are free. The LLM reviews use your API path, so they cost tokens or subscription usage on top of your session. The plugin logs an estimated cost per review.
Which model does it use?
The newest Claude Opus by default. Set SECURITY_REVIEW_MODEL for the diff review and SG_AGENTIC_MODEL for the commit reviewer to pin or use a cheaper model.
Can I add company-specific rules?
Yes. Put a claude-security-guidance.md file in ~/.claude or your project's .claude directory. It is appended to the diff review prompt, up to an 8 KB budget.
What are the prerequisites?
Claude Code CLI v2.1.144 or later, Python 3.8 or later on PATH, and credentials for the LLM reviews such as your Claude Code sign-in or an API key.