security-guidance

What it does

The scoped README distinguishes lightweight pattern warnings, model-assisted diff review and an agentic commit review. The package includes hooks. These layers inspect different stages of a change and may read surrounding files, so this is broader than a static checklist pasted into a prompt.

Best for

A developer who already reviews security-sensitive changes and wants additional observations while editing or committing. It can support a review process, but a catalog listing does not establish detection accuracy or replace threat modeling.

Tradeoffs

The source documents a Claude Code version requirement, a Python runtime and credentials for model-backed reviews. Those reviews can consume account or API resources. Inspect which files are read, how the provider is selected and what behavior runs on each hook before enabling it in a private project.

A practical first task

Start with a disposable repository and a harmless synthetic example of a risky pattern. Identify which layer produced a finding and which credentials it used. Confirm the cost and data boundary before testing a larger diff.

What to validate

Check a known risky case and a benign case, and verify that a failed review is distinguishable from no finding. Do not interpret an empty result as a security clearance. AI Craft Pad did not execute these hooks or model calls.

Compatibility

claude-code

Publisher manifest for claude-code; runtime behavior not tested

Compatibility source

Installation and requirements

The checked README lists Claude Code 2.1.144 or newer, a Python runtime and credentials for model-backed reviews. Review the current client/provider support before use.

Command documented in the scoped README for Claude Code; not executed here. Model-backed review can consume account or API resources.

/plugin install security-guidance@claude-plugins-official

Open the pinned package below and follow its publisher instructions for your agent. A Skills installer is not a universal plugin installer. Review hooks, bundled MCP connections, permissions and configuration before enabling the package.

Detected formats

• .claude-plugin/plugin.json — plugins/security-guidance/.claude-plugin/plugin.json

Bundled components

Skills Declared

No

Mcp Declared

No

Hooks Declared

No

Skills Present

No

Mcp Config Present

No

Hooks Present

Yes

Apps Declared

No

Presence is a static file/manifest observation. A missing declaration does not prove the component is absent at runtime.

Read publisher setup ↗

Unknown; source software and connected services may have separate terms.