# How to Use the Security-Reviewer Agent for Vulnerability Detection with Claude Code

> Discover how to use the security-reviewer agent with Claude Code to automatically detect OWASP Top 10 vulnerabilities, secrets, and insecure dependencies in your repositories.

- Repository: [Affaan Mustafa/everything-claude-code](https://github.com/affaan-m/everything-claude-code)
- Tags: how-to-guide
- Published: 2026-03-20

---

**The security-reviewer agent is a specialized Claude Code tool that automatically scans repositories for OWASP Top 10 vulnerabilities, hard-coded secrets, and insecure dependencies by executing sandboxed security commands and structured pattern analysis.**

The security-reviewer agent in the **affaan-m/everything-claude-code** repository provides automated vulnerability detection directly within your Claude Code workflow. This specialized agent analyzes security-sensitive code changes—such as authentication handlers, API endpoints, and user input processing—to surface critical issues before they reach production.

## Architectural Components of the Security-Reviewer Agent

The agent operates through six integrated components defined in [`agents/security-reviewer.md`](https://github.com/affaan-m/everything-claude-code/blob/main/agents/security-reviewer.md):

- **Agent definition** – Declares the agent’s name, description, required tools, and model configuration. Claude Code reads this file to determine when to offer the security-reviewer option based on context keywords like *auth*, *input*, *API*, or *payment*.

- **Analysis commands** – Executes `npm audit` and `eslint-plugin-security` within a sandboxed Bash environment via the `Bash` tool to perform static security scans.

- **OWASP checklist (lines 34-45)** – Provides structured validation checks covering Injection, Broken Authentication, XSS, and other OWASP Top 10 categories. The agent iterates through each item using `Grep` and `Glob` searches to verify compliance across the codebase.

- **Pattern-rule table (lines 49-60)** – Lists concrete code patterns to flag, including hard-coded secrets, concatenated SQL queries, and unsafe `innerHTML` usage. When matched, the agent reports severity levels and remediation suggestions.

- **Remediation guidance (lines 81-86)** – Defines protocols for documenting, alerting, and fixing critical findings, which the agent includes directly in its response output.

- **Success metrics (lines 96-100)** – Establishes scan completion criteria: zero critical issues, up-to-date dependencies, and completed checklist validation. Claude Code uses these metrics to determine whether a review passed or requires additional work.

## Three-Step Security Workflow

The security-reviewer agent follows a structured three-phase analysis process:

1. **Initial Scan** – Executes `npm audit --audit-level=high` and `npx eslint . --plugin security` to identify dependency vulnerabilities and static analysis warnings. The agent simultaneously searches for hard-coded credentials and obvious security red flags.

2. **OWASP Top 10 Review** – Validates each OWASP category using pattern searches to ensure proper mitigations are implemented, such as parameterized queries for injection prevention and Content Security Policy headers for XSS protection.

3. **Code-Pattern Review** – Flags high-severity patterns from the rule table, attaching concise remediation guidance specific to each finding's file and line number.

## How to Invoke the Security-Reviewer Agent

Claude Code automatically surfaces the security-reviewer option when your session context involves security-sensitive keywords. You can invoke the agent **proactively** after completing security-critical changes or **reactively** by requesting a specific audit.

### After Modifying Security-Sensitive Code

When you complete work on authentication systems, payment handlers, or user input processing, trigger the agent with:

```text
/agent security-reviewer

```

Claude Code will execute the full analysis workflow and return a structured report with line-level references linking directly to source files on GitHub.

### Performing a Full Repository Audit

For comprehensive scanning across the entire codebase, use the `--full` flag:

```text
/agent security-reviewer --full

```

This executes analysis commands across all directories, aggregates findings per file, and presents a severity-ordered summary table.

## Practical Usage Examples

### Reviewing a New API Endpoint

After adding a payment processing route, invoke the agent to validate the implementation:

```text
User: I just added POST /api/payments. Run a security review.
Claude Code: /agent security-reviewer

```

The agent executes:
- `npm audit --audit-level=high`
- `npx eslint . --plugin security`
- Pattern searches in [`src/app/api/payments/route.ts`](https://github.com/affaan-m/everything-claude-code/blob/main/src/app/api/payments/route.ts) for hard-coded secrets, unsanitized URLs, and missing authentication checks

Results include direct links to specific lines requiring attention.

### Applying Remediation Suggestions

When the agent identifies an issue, it provides actionable fixes. For example:

```text
Issue: Hard-coded secret found in src/lib/config.ts (L42).
Fix: Replace const API_KEY = "sk_test_12345" with process.env.API_KEY.

```

Apply the correction using Claude Code's edit functionality:

```text
/edit src/lib/config.ts
Old: const API_KEY = "sk_test_12345"
New: const API_KEY = process.env.API_KEY!

```

After editing, re-run `/agent security-reviewer` to verify the vulnerability is resolved and the success metrics (lines 96-100) indicate no critical issues remain.

## Key Configuration Files

The security-reviewer agent relies on these specific files in the **affaan-m/everything-claude-code** repository:

- **[`agents/security-reviewer.md`](https://github.com/affaan-m/everything-claude-code/blob/main/agents/security-reviewer.md)** – Contains the complete agent metadata, workflow definition, OWASP checklist (lines 34-45), pattern-rule table (lines 49-60), and success metrics (lines 96-100).

- **[`skills/security-review/SKILL.md`](https://github.com/affaan-m/everything-claude-code/blob/main/skills/security-review/SKILL.md)** – Provides general security-review guidelines that the agent references for deeper analysis context.

- **[`package.json`](https://github.com/affaan-m/everything-claude-code/blob/main/package.json)** – Defines the `eslint-plugin-security` dependency and npm scripts required for the agent's static analysis capabilities.

## Summary

- The **security-reviewer agent** operates from [`agents/security-reviewer.md`](https://github.com/affaan-m/everything-claude-code/blob/main/agents/security-reviewer.md) to provide automated vulnerability scanning within Claude Code.
- It validates code against the **OWASP Top 10** using a structured checklist (lines 34-45) and pattern matching (lines 49-60).
- Invoke the agent using `/agent security-reviewer` for targeted scans or `/agent security-reviewer --full` for repository-wide audits.
- The agent executes **sandboxed commands** including `npm audit` and `eslint-plugin-security` to detect dependency and code-level vulnerabilities.
- Remediation guidance (lines 81-86) provides immediate fix suggestions with direct links to affected source lines.

## Frequently Asked Questions

### How does the security-reviewer agent identify specific vulnerabilities?

The agent combines static analysis tools with structured pattern matching. It executes `npm audit` for dependency vulnerabilities and `eslint-plugin-security` for code-level issues, then applies the OWASP checklist (lines 34-45) and pattern-rule table (lines 49-60) from [`agents/security-reviewer.md`](https://github.com/affaan-m/everything-claude-code/blob/main/agents/security-reviewer.md) using `Grep` and `Glob` searches to locate hard-coded secrets, injection risks, and authentication flaws.

### When should I trigger a security review in Claude Code?

Invoke the security-reviewer agent immediately after modifying code involving user input handling, authentication mechanisms, API endpoints, payment processing, or configuration files containing secrets. Claude Code automatically suggests the agent when your chat context includes security-related keywords, but you can manually request reviews using `/agent security-reviewer` whenever you need validation.

### What happens if the agent finds critical vulnerabilities?

When the agent detects critical issues, it references remediation guidance (lines 81-86) to generate specific fix instructions, including the exact file path and line number. The agent reports findings with GitHub links to the problematic code and waits for you to apply fixes. Success metrics (lines 96-100) require zero critical issues and completed checklist validation before the review is considered complete.

### Can I use the security-reviewer agent with non-JavaScript codebases?

The agent's current implementation in **affaan-m/everything-claude-code** utilizes JavaScript-specific tools like `npm audit` and `eslint-plugin-security`, but the architectural pattern supports extension. The OWASP checklist (lines 34-45) and pattern matching logic operate independently of language, though you would need to configure additional static analysis tools in the agent definition for Python, Go, or other languages.