Security review skills for AI coding agents in 2026

Claude Code, Codex and other coding agents can run a security review, and it is easy to fool yourself about what that review covers. Below is a map of the security review commands, plugins and skills that exist in November 2026, the commands to run each one, a plain account of what they catch and what they skip, a CI layout that pairs them with deterministic scanners, and a checklist for vetting third-party skills before they run on your machine.

Most of my background sits at the other end of this problem: incident response, malware and ransomware recovery, and hardening servers after something got through. That bias shows below. An agent review is a useful extra reader of your code. It is not a control.

What exists in November 2026

Three groups of tools have settled out. The agent vendors ship their own review commands. Security firms publish skills that turn a general agent into an auditor. Scanner vendors connect their deterministic engines to agents through hooks and MCP.

Tool	Publisher	Where it runs	What it reviews	Access
Security guidance plugin	Anthropic	Claude Code session, automatic	Code Claude writes: per edit, per turn, per commit	All plans
/security-review	Anthropic	Claude Code, on demand	Changes on the current branch	Built in
Claude Security plugin	Anthropic	Claude Code, on demand	Whole repo, branch diff, PR or commit	Paid plan, API access or a third-party provider
claude-code-security-review	Anthropic	GitHub Actions	Pull request diff	Anthropic API key, MIT licence
Codex Security plugin and CLI	OpenAI	Codex app, terminal, CI	Repo, selected paths or a Git diff	Codex Security access for OpenAI inference
Codex Security Review	OpenAI	GitHub pull requests	PR diff and supporting code	ChatGPT Enterprise, Business, Edu and Pro (not Plus)
security-audit skill	Cloudflare	Any agent with tool use and parallel sub-agents	Whole repository, six phases	MIT licence
Trail of Bits skills	Trail of Bits	Claude Code plugin marketplace	Diff review, static analysis, insecure defaults, supply chain	CC-BY-SA-4.0
Semgrep Guardian and MCP	Semgrep	Agent hooks and MCP	Each file the agent writes, plus platform findings	Hosted MCP needs a Teams or Enterprise plan

Claude Code

Anthropic now documents four layers. The security guidance plugin runs without being invoked: a regex check on every file edit (no model call), a background model review of each turn’s diff (up to 30 changed files), and a deeper agentic review when Claude itself runs git commit or git push. None of these layers block a write or a commit. Findings go back to Claude as instructions.

/security-review is a single pass over the changes on your current branch. The Claude Security plugin (/claude-security) is the deep option: agents map the architecture, build a threat model, hunt, and have independent verifiers check every finding before it reaches the report. Results land in a CLAUDE-SECURITY-<timestamp>/ folder as Markdown, JSONL and SARIF 2.1.0 with CWE categories. For pull requests, Code Review runs on Team and Enterprise plans, and the managed Claude Security service is on Enterprise.

OpenAI Codex Security

Codex Security comes as a desktop plugin, a CLI (cs), an SDK, a hosted Codex Security Cloud (in research preview) and Security Review for GitHub pull requests. The CLI scans a repository, selected paths or a diff, validates candidates, generates patches and exports SARIF, JSON and CSV. Cloud scans build an editable threat model of entry points, trust boundaries and sensitive actions, and use it to rank later commit scans.

Cloudflare’s security-audit skill

Cloudflare published this skill on 18 June 2026 alongside a post by Grant Bourzikas on building a vulnerability harness. It started as a roughly 450-line skill run on one repository, and grew into an internal harness that covered 128 repositories. The public skill runs six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and reporting. Each finding ends as confirmed, needs_validation or rejected.

Trail of Bits skills

The trailofbits/skills marketplace holds review-oriented plugins. The ones I would start with are differential-review (security review of changes using git history), static-analysis (CodeQL, Semgrep and SARIF parsing), insecure-defaults (fail-open configuration), sharp-edges (footgun APIs) and supply-chain-risk-auditor (npm, PyPI and Go dependencies, abandoned upstreams, install scripts).

Semgrep Guardian and MCP

Guardian bundles the Semgrep MCP server, hooks and skills into one install. It scans every file the agent writes with Semgrep Code, Supply Chain and Secrets, and returns findings to the agent, which decides whether to regenerate. The hosted MCP server, in beta, lets an agent search and triage findings on the Semgrep AppSec Platform and needs a Teams or Enterprise plan. For local scanning, Guardian runs the MCP server with semgrep mcp from the CLI.

How an agent security review works

Every serious tool here follows the same shape: gather context, generate candidate bugs, try to knock each one down with a fresh agent, and report only what survives.

The /security-review prompt is public, so you can read exactly what it does. It loads git status, the changed files, the commit log and the diff against origin/HEAD. It then researches the repository’s existing security patterns, compares the new code against them, and traces data from inputs to sensitive operations. Each candidate is handed to a separate parallel sub-task with false-positive rules, and anything scoring below 8 out of 10 for confidence is dropped.

The security guidance plugin makes the same choice: its model reviews run as a separate call with a fresh context that “has no investment in the original approach”. Cloudflare’s harness goes further. Its validator cannot log findings of its own and exists only to disprove the hunter’s theory.

That verification step is why these tools are now usable. It is also why they miss real bugs. A high confidence threshold trades recall for precision, and the trade is made for you unless you edit the prompt.

Running a review with the commands that exist today

Before you push: /security-review

Run it inside a Claude Code session in a clone that has a remote, because the prompt diffs against origin/HEAD:

/security-review

To add your own rules, copy the command file from Anthropic’s repository into your project and edit it. Read it before you commit it, as you would any prompt that runs with tool access:

mkdir -p .claude/commands
curl -fsSL -o .claude/commands/security-review.md \
  https://raw.githubusercontent.com/anthropics/claude-code-security-review/main/.claude/commands/security-review.md

If you also run the security guidance plugin, put your threat model in .claude/claude-security-guidance.md. The model-backed reviews load it alongside their built-in checklist:

# Security guidance for this repo
- Every route under /admin must check the admin role before any database read.
- Never log customer email addresses or tokens at INFO level or above.
- All queries in src/tenants must filter by org_id.

These are guidance for the reviewer, not guardrails. Anthropic’s docs say so directly and point you to hooks or CI checks for hard enforcement.

Before a release: Claude Security at high effort

/plugin install claude-security@claude-plugins-official
/claude-security scan my branch at high

A full scan can take a while and use a significant number of tokens, and Claude Code must stay open while it runs. When it finishes, pick Suggest patches from the menu. Patches are drafted in a scratch copy, reviewed by a separate agent, and never applied automatically:

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

Apply each patch in its own pull request so your normal tests and reviewers see it.

Codex Security from the terminal

The CLI needs Node.js 22.13 or later within 22.x, or Node.js 24 or 26, plus Python 3.10 or later:

npm install --global @openai/codex-security
cs login
cs scan . --diff origin/main
cs scan . --mode deep

On GitHub, comment @codex security review on a pull request, or turn on Auto security review in Codex settings. One point to note: findings posted to a pull request inherit its visibility, so on a public repository anyone can read them. For public projects, keep the full report in Codex and fix before you publish details.

Cloudflare’s skill in any capable agent

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Then ask the agent for a full security audit of the repository. Results default to ~/security-audit-skill/<repo-name>/run-<N>. The README requires an OS-enforced sandbox with external networking disabled before the skill builds or runs target code. Without one, leads stay as needs_validation rather than being executed. Do not skip this to get more confirmed findings.

In CI: the Claude Code security review Action

The README shows @main. I pin it to a reviewed commit instead; the SHA below is the head of main as of 11 November 2026:

name: Security Review

permissions:
  pull-requests: write
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      # README uses @main. Pin to a commit you have read.
      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

The README is blunt: the action “is not hardened against prompt injection attacks and should only be used to review trusted PRs”. A pull request is attacker-controlled text, and a comment in the diff can try to talk the reviewer out of a finding. On public repositories, turn on “Require approval for all external contributors” so the workflow runs only after a maintainer has looked at the change.

What agent reviews catch, and what they leave out

The strength is context. Anthropic lists authorisation bypass, insecure direct object references, injection, server-side request forgery and weak cryptography as issues “a string match cannot” catch. These are questions like “does this handler check the tenant before it reads?” A model that reads the surrounding code can answer them. A regex cannot.

The gaps are just as specific. The /security-review prompt tells the model to exclude, among other things:

• Denial of service, resource exhaustion and rate limiting.
• Vulnerabilities in outdated third-party libraries, which “are managed separately”.
• Secrets stored on disk if otherwise secured.
• Files that are only tests, and documentation.
• Most GitHub Actions workflow issues unless there is a concrete attack path.
• Open redirects, prototype pollution and similar issues unless confidence is extremely high.
• Existing problems: it focuses “ONLY on security implications newly added by this PR”.

That last line matters. /security-review will not tell you about the SQL injection that has been in main for two years. Anthropic’s own advice is to ask Claude to review specific files, or to run the Claude Security plugin, for code you already have.

Three more limits apply to every tool here:

1. Results vary between runs. Anthropic says two scans of the same code can surface different findings. Cloudflare found that a single run caught roughly half of the vulnerabilities that repeated runs found in total.
2. They read source, not systems. The review reads the code in your checkout, “not a running site or deployed service”. An exposed admin panel, a weak TLS setup or a missing WAF rule is invisible to it.
3. They do not block. The security guidance plugin does not stop a write or a commit, and the model can miss issues.

Pair agent reviews with deterministic scanners

A deterministic scanner gives the same result for the same input, has stable rule IDs, and can fail a build without arguments about whether today’s run was unlucky. It also covers exactly what the agent prompts exclude: dependency CVEs, secrets and known-bad patterns. The agent covers logic and authorisation, which rules handle poorly.

Stage	Deterministic gate	Agent, advisory
While coding	Semgrep Guardian scan on each written file	Security guidance plugin
Pull request	Semgrep or CodeQL, dependency review, secret push protection	/security-review, the Action, or Codex Security Review
Dependencies	OSV-Scanner, Dependabot or Renovate, Socket	supply-chain-risk-auditor to triage
Before release	Full SAST run, Trivy on images and IaC	Claude Security at high effort, Cloudflare’s skill
Running system	External scans, WAF and header checks	Not covered by code review

I compare the scanners in SAST tools compared and dependency scanning tools compared. Four rules make the pairing work:

1. Gate merges on deterministic tools only. A check whose findings change between runs makes a poor required status check.
2. Put findings in one place. Claude Security writes SARIF 2.1.0 and the Codex CLI exports SARIF, so agent findings can sit beside CodeQL and Semgrep results in GitHub code scanning.
3. Turn confirmed agent findings into rules. When an agent finds a real bug class, write a Semgrep rule so the pattern is caught deterministically from then on. Trail of Bits ships semgrep-rule-creator for this.
4. Use the agent to triage scanner noise. Semgrep’s hosted MCP and the Trail of Bits static-analysis plugin both read existing findings, which is a cheaper job for a model than hunting from scratch.

The same split shapes the product I am building. NoDowntime Security runs over 30 external security checks against what is actually deployed, and its GitHub App checks pull requests for exposed secrets. Both are deterministic on purpose. Agent review sits beside them, not in place of them.

The risks of installing third-party skills

A skill is not documentation. It is a folder with a SKILL.md and, often, scripts that the agent executes. Claude Code’s docs add two details every reviewer should know:

• The allowed-tools field lets a skill use the listed tools “without asking permission during the turn that invokes this skill”.
• “Workspace trust doesn’t gate this field.” A project skill checked into a repository applies its allowed-tools even in a claude -p run in a folder you have never trusted. Review skills in any repository before you run Claude Code there. To stop skills from running the shell commands embedded in their content, the docs cover "disableSkillShellExecution": true.

The ecosystem has already been attacked. Snyk’s ToxicSkills study scanned 3,984 skills from ClawHub and skills.sh as of 5 February 2026. It found 534 skills (13.4%) with at least one critical issue and confirmed 76 malicious payloads built for credential theft, backdoor installation and data exfiltration. Every confirmed malicious skill contained malicious code patterns and 91% also used prompt injection. In Snyk’s detection table, the curated top 100 on skills.sh scored 0% on all three critical policies, while the full ClawHub set did not. Since February 2026 Socket has also scanned skills listed on skills.sh. I cover that directory in the skills.sh guide.

Security tools are a favourite target because they run with secrets. In March 2026 an attacker used compromised credentials to force-push 76 of 77 version tags of aquasecurity/trivy-action to credential-stealing code. Anyone who referenced a tag rather than a commit SHA ran it. A popular security skill with a mutable reference is the same risk with a friendlier README.

Before installing any skill or plugin:

1. Read SKILL.md, every script and any hooks or MCP servers it adds. Claude Code’s install pane lists what a plugin will install; read it.
2. Check allowed-tools. A review skill needs read access and git commands, not curl or unrestricted Bash.
3. Pin it. Marketplaces can be added with #ref to pin a tag, and auto-update is off by default for third-party marketplaces. Leave it off and update on purpose.
4. Run new skills in a container or VM with no cloud credentials, no SSH keys and no production .env files.
5. Prefer the vendor’s own marketplace and repository over a re-upload in a directory.
6. Re-read the diff when you update.

My own setup notes for permissions and hooks are in the Claude Code setup guide.

If the code is about to go live, how to launch a vibe-coded app securely turns these reviews into a full launch checklist, from secrets to uptime alerts.

Where each tool fits

• Run /security-review before every push on branches that touch auth, input handling or data access. Remember it only looks at new changes.
• Run Claude Security or Cloudflare’s skill at high effort before a release, more than once, and in a sandbox when target code runs.
• Use Codex Security Review or the Claude Code Action on trusted pull requests only, pinned to a commit SHA.
• Keep SAST, dependency, container and secret scanners as the required checks. Agents comment; scanners gate.
• Send agent SARIF into the same code scanning view as your scanners, and convert confirmed findings into rules.
• Vet every third-party skill as code: read it, restrict allowed-tools, pin it, and keep secrets out of reach.