claude-security

name	claude-security
description	The Claude Security menu — pick a job: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose).
disable-model-invocation	true
allowed-tools	["Read","Write","Glob","Grep","AskUserQuestion","Workflow","Workflow(claude-security:scan)","Agent(claude-security:scan-inventory, claude-security:scan-researcher, claude-security:scan-verifier, claude-security:patch-generator, claude-security:patch-verifier, claude-security:explore)","Bash(date *)","Bash(ls *)","Bash(wc *)","Bash(mkdir -p *)","Bash(git *)","Bash(GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0 git *)","Bash(find . -maxdepth 1 -type d -name \"CLAUDE-SECURITY-2*\")","Bash(python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/render_report.py\" *)","Bash(python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/write_scan_meta.py\" *)","Bash(python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/patch_artifacts.py\" *)","Bash(sleep *)","Bash(GIT_TERMINAL_PROMPT=0 git *)"]

Claude Security

• Session start time (UTC, the stamp report directories are named with): !date -u +%Y%m%d-%H%M%S

The front-desk menu

This is the front desk. Its whole purpose is to work out which job the user wants and drive it, following that job's recipe.

1. If the user already asked for a specific job — in the arguments ($ARGUMENTS) or in plain text ("scan this repo", "scan my branch", "fix the findings", a bare commit sha) — do that job directly and skip the menu. The recipe still asks its own single follow-up question wherever the request left one open.