Claude Code, Plugin
Claude Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code.
Compatibility: Claude Code.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 6e50442cd643.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
workflows/scan.js, line 41
},Me=[[20,102,105,106,108,109,112,179,180,181,554,622,696,781,1173,1174,1285,1286,1287,1288,1289],[22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,160],[59,61,62,64,65,138
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
hooks/hooks.py, line 322
out = subprocess.run(
scripts/patch_artifacts.py, line 535
out = subprocess.run(
scripts/patch_artifacts.py, line 1141
shutil.rmtree(root, onerror=functools.partial(retry_removal, root))
Show more
scripts/patch_artifacts.py, line 1184
shutil.rmtree(root, onerror=functools.partial(retry_removal, root))
scripts/render_report.py, line 923
shutil.rmtree(str(target))
scripts/lib/git.py, line 15
out = subprocess.run(
skills/claude-security/specs/patch-spec.md, line 27
{ "kind": "set_aside", "text": "GET /admin/diag?host= reaches subprocess.run with shell=True at admin/diag.py:12; a command injection, pre-existing and unrelated to this finding" }
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
workflows/scan.js, line 41
},Me=[[20,102,105,106,108,109,112,179,180,181,554,622,696,781,1173,1174,1285,1286,1287,1288,1289],[22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,160],[59,61,62,64,65,138
Licence
Pass
A licence file is present (plugins/claude-security/LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6e50442cd643. can delete files. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 6e50442cd64387efad73bab72a47f277b88d8662
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.