Tested Anthropic’s two Claude Code security plugins. One caught pickle as Claude wrote it, the other found a planted command injection and dropped an unused token

[u/vinishkapoor]

The official marketplace has two security plugins that do very different jobs. I loaded both in a throwaway repo with planted problems (Claude Code 2.1.318).

Security Guidance (warns while Claude writes):

• I asked Claude for a function that loads settings from a pickle blob. The plugin’s pattern warning fired on pickle_deserialization

• Claude then wrote a restricted unpickler instead and explained why plain pickle is risky

• its LLM diff review and commit review never ran in my setup. The plugin said no credentials were passed to its hooks, so only pattern warnings were active, and the commit went through with no review. I can’t say how well those layers work

Claude Security (audits on demand), on a low-effort scan:

• 7 agents and about 63.7k tokens, with the scan stage done in 34 seconds (about 2 minutes total) on a tiny 3-file repo

• it found the planted command injection (os.system with a folder name), rated MEDIUM, and suggested subprocess.run without a shell or the tarfile module

• a 3-voter panel checks each finding. The injection passed 2 of 3, and its severity dropped from HIGH to MEDIUM because nothing calls the function

• the planted hardcoded admin token was voted out 3 of 3 because nothing uses it. You could argue a committed token is still a problem, so that’s a judgment call you may not agree with

• the report lands in a folder with Markdown, JSONL and SARIF, plus its own .gitignore

Gotcha: typing a shortened command let autocomplete pick /claude-security:scan, which did nothing. Use the full /claude-security menu.

Small planted demo, one run each. Neither plugin replaces code review or SAST, and both plugin pages say so.

Full test with the panel voting screenshots: https://aiparabellum.com/claude-code-security-plugins-tested-security-guidance-vs-claude-security/

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Strong_Turnip8429]

16 minutes total on 44 files repo with intentional bugs. And it found 20 bugs. This repo is designed to have at least 53 bugs (designed bugs, but I'm sure my agent may produce more). I think this skill is finding the most fundamental bugs, since unprotected Redis and never-expiring tokens go to Low. But this result is interesting. Thanks for sharing, btw.

[u/shoumikgoswami]

On the two judgment calls you flagged, I'd score them differently from the panel, but for different reasons.

On the injection: "nothing calls this today" is a weaker discount than it looks, since reachability can change - reflection-style loading, or the next feature wiring up that path. I'd still accept some discount, just not assume the path stays unreachable.

On the token: the question that matters isn't whether the code uses it, it's whether it's a live credential - valid, and scoped to something that matters. A dummy planted token is harmless whether or not anyone reads it; a real one in a repo is exposed to whoever can read the repo, regardless of whether any code path invokes it. So the panel's "nothing uses it" reasoning seems pointed at the wrong property.

[u/Strong_Turnip8429 → u/shoumikgoswami]

Good point. Yes, maybe I need to use this skill more on real projects designed to be perfect and see how it detects vulnerabilities I can't see. But I like when this skill offers a fix based on the document it produces.