Anthropic's Security Skills: What They Actually Do
In short
There is no single thing called "Anthropic's security skills". There are five separate pieces with confusingly similar names, and only one of them literally ships as Skills. In a Claude Code session you get the security-guidance plugin (free on all plans, reviews code as Claude writes it), the claude-security plugin (paid plans, a multi-agent scan you run on demand), and the built-in /security-review command (one pass over your branch diff). Outside the session there is the claude-code-security-review GitHub Action for pull requests, and the managed Claude Security product in public beta for Enterprise. The actual Skills live in anthropics/defending-code-reference-harness — threat modelling, scanning, triage and patching — and its README says the repo is not maintained. None of these replaces a SAST tool: they are nondeterministic, they do not block merges, and the docs say so. Details verified as of July 2026.
What Anthropic shipped
The naming is the hardest part. Here is the whole landscape, with the distinctions that change your decision.
| What | Form | Runs where | Plan | Cost |
|---|---|---|---|---|
| security-guidance | Plugin (hooks) | In-session, automatic | All plans | Pattern layer free; model layers use quota |
/security-review |
Built-in command | On demand, your branch | Claude Code | One model pass |
| claude-security | Plugin (/claude-security) |
On demand, local session | Paid plans | Can burn significant tokens |
| Code Review | Product feature | On pull requests | Team, Enterprise | In plan |
| Claude Security | Managed service | Hosted, connected repos | Enterprise beta | Contract |
| defending-code-reference-harness | Skills + harness | Your machine, sandboxed | API key | Your API spend |
The one people usually mean by "Anthropic cybersecurity skills" is the security-guidance plugin, because it runs by default once installed and shows up in a normal working session.
The one that actually is Skills is the last row. anthropics/defending-code-reference-harness is MIT-licensed and ships nine skill directories — threat-model, vuln-scan, triage, patch, verify, customize, quickstart, plus dnr-hunt and dnr-respond for detection and response. Read its README first: the repo states it is not maintained and not accepting contributions, the harness is a reference rather than a product, and the pipeline is built for memory-safety bugs in C and C++. Porting it elsewhere is the /customize skill's whole job, which tells you how much work that is.
What the skills actually check
The security-guidance plugin is the interesting one, because it is three mechanisms wearing one name. From Anthropic's documentation:
On each file edit. A deterministic string and regex match against roughly two dozen known-dangerous patterns — eval(, new Function, os.system, child_process.exec, pickle, dangerouslySetInnerHTML, .innerHTML =, document.write, and edits under .github/workflows/. No model call, so no cost. The warning goes into Claude's context for its next step, once per pattern per file per session.
At the end of each turn. The plugin diffs what the turn changed and sends it to a separate Claude call with a security-focused prompt. This layer catches what a string match cannot: authorization bypass, IDOR, injection, SSRF, weak cryptography. It covers up to 30 changed files per turn and fires at most three times in a row.
On commit or push. When Claude runs git commit or git push through its Bash tool, a deeper agentic review reads surrounding code — callers, sanitizers, related files — before deciding a finding is real. Capped at 20 reviews per rolling hour.
The independence point is easy to miss and it matters: the reviewing model is not the instance that wrote the code. It starts from the diff with a fresh context and no investment in the approach — better than asking a model to grade its own homework, and the reason the end-of-turn layer catches anything at all.
The claude-security plugin is a different shape: a multi-agent scan you invoke deliberately. Agents map your architecture, build a threat model, hunt, and independently verify each finding before it reaches the report. Results land in a timestamped CLAUDE-SECURITY-<timestamp>/ directory with a Markdown report, a JSONL file, and a revision stamp recording which commit was scanned. Patches are never applied for you — you run git apply yourself.
Installing and running them
Both plugins install from Anthropic's official marketplace:
/plugin install security-guidance@claude-plugins-official
/plugin install claude-security@claude-plugins-official
/reload-plugins
If Claude Code reports that the marketplace is not found, add it with /plugin marketplace add anthropics/claude-plugins-official and retry.
Check the prerequisites before filing a bug. security-guidance needs Claude Code 2.1.144+ and Python 3.7+ on your PATH, with 3.10+ for the agentic commit review; on first run it creates a virtualenv under ~/.claude/security/ and installs the Claude Agent SDK into it, which needs pip and network access. The end-of-turn and commit reviews need a git repository and skip silently outside one. claude-security needs Claude Code 2.1.154+ on a paid plan and Python 3.9.6+.
Two configuration files matter. .claude/claude-security-guidance.md holds your threat model in plain language for the model-backed reviews to load as context. .claude/security-patterns.yaml adds your own regex or substring rules to the per-edit layer, capped at 50. Both are additive only: you can add checks, but not switch built-in ones off. Individual layers turn off through environment variables (ENABLE_PATTERN_RULES=0, ENABLE_STOP_REVIEW=0, ENABLE_COMMIT_REVIEW=0).
On which plugins are worth the session overhead in general, the same trade-offs apply as in Claude Code skills worth installing.
How they compare to a real SAST tool
They are not competing. Anthropic's own documentation says the plugin "doesn't replace your existing source-code security tools" and positions it as one layer of defence in depth. Take that seriously: the failure mode of ignoring it is a team that quietly deletes its Semgrep job.
| Claude's security review | Traditional SAST | |
|---|---|---|
| Determinism | Two scans of the same code can differ | Same input, same output |
| Merge gating | No layer blocks a write, commit or merge | Fails the build on new findings |
| Reasoning | Traces data flow across files, reads intent | Pattern and dataflow rules per language |
| Output | Markdown report plus JSONL | SARIF, CWE-mapped, feeds dashboards |
| False positives | Independent verifier pass | Rule tuning and suppressions |
| Dependencies | Not attempted | Standard in SCA tooling |
| Cost per run | Model tokens; deep scans add up | Fixed, per seat or per repo |
The nondeterminism row decides your architecture. A check whose output varies between runs cannot be a required status check — you would be blocking merges on a coin flip. That is why all of these tools report rather than gate, and why Anthropic ships a revision stamp with each scan: the report is an artefact tied to a commit, not a pass/fail signal.
What Claude adds is the class of bug rules struggle with — an authorization check missing three files from where the data is read, an IDOR that exists only because two functions disagree about who owns a record.
Where they miss
Nothing blocks. Findings reach the writing Claude as instructions. Claude usually fixes them. Sometimes it argues, and sometimes the review misses the issue — Anthropic's docs say plainly that the review model can miss issues.
Only Claude's commits are reviewed. The commit layer fires on git commit and git push that Claude runs through its Bash tool. Commits you make from your own terminal — including the ! shell escape inside a session — are not reviewed. If your habit is to review Claude's diff and commit it yourself, you have turned off the deepest layer without noticing.
The GitHub Action is not hardened against prompt injection. anthropics/claude-code-security-review is MIT-licensed and useful, but its README says it should only review trusted PRs. Running an agentic reviewer over untrusted pull-request content is exactly the attack surface described in prompt injection hidden in documents. Its false-positive filter also drops whole classes by design: denial of service, rate limiting, resource exhaustion, open redirects, and input validation without proven impact.
No supply-chain coverage. None of these scan your dependency tree, lockfile or package provenance. For agent tooling specifically, MCP supply-chain risks are their own category a code scanner does not touch.
Cost is real on the deep scan. The per-edit layer is free; everything else spends model tokens against your plan's usage. The claude-security docs warn a scan "may use a significant number of tokens" and needs the session left open. On a large repository, scan one area at a time.
One odd edge case. Anthropic documents that Fable 5's cybersecurity safety classifiers can flag activity mid-scan and downgrade the model to Opus. The scan still completes — expected, not a bug.
FAQ
Does Claude Code have a built-in security scanner?
Yes, /security-review, which runs a single security pass over your current branch diff and needs no installation. The security-guidance plugin is the automatic version that runs continuously as Claude works; the claude-security plugin is the deep multi-agent scan you invoke when you want a real audit.
Is the security-guidance plugin free?
The plugin is available on all plans and the per-edit pattern check makes no model call, so it adds no cost. The end-of-turn and commit reviews are separate Claude calls that count against your usage like any other request — roughly one per turn that changes files, plus a deeper one per commit, capped at 20 commit reviews per rolling hour.
Can Claude's security review replace Semgrep or Snyk?
No, and Anthropic does not claim it can. The reviews are nondeterministic, so they cannot serve as a required merge check, and none of them scan dependencies. Run them alongside your existing static analysis and SCA. Where they earn their place is cross-file logic flaws that rule-based tools do not model.
What are Anthropic's security Skills, exactly?
The only Anthropic repository that ships security work as Claude Skills is defending-code-reference-harness: threat-model, vuln-scan, triage, patch, verify and customize, plus two detection-and-response skills. It is MIT-licensed, and its README states the repo is not maintained and is a reference rather than a product. The pipeline targets memory-safety bugs in C and C++, and the autonomous mode refuses to run outside a gVisor sandbox unless you override it. Worth reading; not something to depend on. Other skills live in the arsenal.
Should I trust the patches it suggests?
Review them. The claude-security plugin builds each patch in a scratch copy of your repository and has a second agent verify it addresses exactly one finding, introduces nothing new, and leaves behaviour otherwise unchanged — running your tests when the code has them. When it cannot vouch for all three, you get a note instead of a patch. Good process, still a model writing security-sensitive code. Apply each patch in its own PR.