claude-code-security

name	claude-code-security
description	Scan a local codebase or GitHub repository for security vulnerabilities using Claude Code Security. Returns severity-scored findings and patch suggestions for human review. Say "scan [path] for vulnerabilities", "run a security review on [path]", or "find vulnerabilities in [path]" to trigger this skill.
version	0.1.0
status	preview
metadata	{"openclaw":{"requires":{"env":["ANTHROPIC_API_KEY"],"bins":["claude"]}},"tribe-security":{"network-egress":"api.anthropic.com only","file-access":"read target path, write to ~/openclaw-output/","review-status":"tribe-verified","scanner-result":"0 critical, 0 high, 0 medium","reviewed-by":"tribe-ai","reviewed-at":"2026-02-22"}}

Claude Code Security Scanner

Invoke Claude Code Security via the Claude Code CLI to scan a local codebase or GitHub repository for security vulnerabilities. Surface findings conversationally through OpenClaw.

Status: Preview — This skill depends on Claude Code Security, which is currently a limited research preview for Enterprise and Team Claude customers. Anthropic is offering expedited access for open-source maintainers. This skill will be updated to stable when Claude Code Security is generally available.

Prerequisites

The Claude Code CLI must be installed. To check:

command -v claude >/dev/null 2>&1 || echo "Claude Code CLI is not installed. Visit https://docs.anthropic.com/en/docs/claude-code for installation instructions."

How to use

1. Accept a target. The user will provide a local path or GitHub repository URL to scan.

2. Run the scan. Shell out to the Claude Code CLI:

claude --print "Run a comprehensive security scan on the codebase. Report all findings with severity scores, confidence scores, affected file locations, and suggested patches. Output as structured JSON." --output-format json < /dev/null

3. Capture output. Parse the structured JSON output containing:

   • Severity scores (CRITICAL, HIGH, MEDIUM, LOW, INFO)
   • Confidence scores
   • Affected file locations
   • Suggested patches

4. Write the full report. Save to ~/openclaw-output/security-TIMESTAMP.json.

5. Return a conversational summary. Example: "Found 1 CRITICAL, 3 HIGH, 7 MEDIUM findings in my-repo. Full report written to ~/openclaw-output/security-2026-02-22.json. Want me to walk through the critical finding?"

Critical Guardrail

NEVER auto-apply suggested patches. Every patch suggestion requires a separate, explicit user instruction. This is non-negotiable.

This skill is part of an enterprise security hardening kit. Automatically applying code changes without human review would undermine the entire premise. Always present patches as suggestions and wait for explicit user approval before making any changes.

Constraints

• Network egress to api.anthropic.com only (for Claude API calls via the CLI).
• Read access to the target path specified by the user.
• Write access to ~/openclaw-output/ only for saving reports.
• Do NOT auto-apply patches. Always require explicit human approval.
• Do NOT access any files outside the target path and output directory.