How to Use the Security-Reviewer Agent for Vulnerability Detection with Claude Code

The security-reviewer agent is a specialized Claude Code tool that automatically scans repositories for OWASP Top 10 vulnerabilities, hard-coded secrets, and insecure dependencies by executing sandboxed security commands and structured pattern analysis.

The security-reviewer agent in the affaan-m/everything-claude-code repository provides automated vulnerability detection directly within your Claude Code workflow. This specialized agent analyzes security-sensitive code changes—such as authentication handlers, API endpoints, and user input processing—to surface critical issues before they reach production.

Architectural Components of the Security-Reviewer Agent

The agent operates through six integrated components defined in agents/security-reviewer.md:

• Agent definition – Declares the agent’s name, description, required tools, and model configuration. Claude Code reads this file to determine when to offer the security-reviewer option based on context keywords like auth, input, API, or payment.

• Analysis commands – Executes npm audit and eslint-plugin-security within a sandboxed Bash environment via the Bash tool to perform static security scans.

• OWASP checklist (lines 34-45) – Provides structured validation checks covering Injection, Broken Authentication, XSS, and other OWASP Top 10 categories. The agent iterates through each item using Grep and Glob searches to verify compliance across the codebase.

• Pattern-rule table (lines 49-60) – Lists concrete code patterns to flag, including hard-coded secrets, concatenated SQL queries, and unsafe innerHTML usage. When matched, the agent reports severity levels and remediation suggestions.

• Remediation guidance (lines 81-86) – Defines protocols for documenting, alerting, and fixing critical findings, which the agent includes directly in its response output.

• Success metrics (lines 96-100) – Establishes scan completion criteria: zero critical issues, up-to-date dependencies, and completed checklist validation. Claude Code uses these metrics to determine whether a review passed or requires additional work.

Three-Step Security Workflow

The security-reviewer agent follows a structured three-phase analysis process:

1. Initial Scan – Executes npm audit --audit-level=high and npx eslint . --plugin security to identify dependency vulnerabilities and static analysis warnings. The agent simultaneously searches for hard-coded credentials and obvious security red flags.

2. OWASP Top 10 Review – Validates each OWASP category using pattern searches to ensure proper mitigations are implemented, such as parameterized queries for injection prevention and Content Security Policy headers for XSS protection.

3. Code-Pattern Review – Flags high-severity patterns from the rule table, attaching concise remediation guidance specific to each finding's file and line number.

How to Invoke the Security-Reviewer Agent

Claude Code automatically surfaces the security-reviewer option when your session context involves security-sensitive keywords. You can invoke the agent proactively after completing security-critical changes or reactively by requesting a specific audit.

After Modifying Security-Sensitive Code

When you complete work on authentication systems, payment handlers, or user input processing, trigger the agent with:

/agent security-reviewer

Claude Code will execute the full analysis workflow and return a structured report with line-level references linking directly to source files on GitHub.

Performing a Full Repository Audit

For comprehensive scanning across the entire codebase, use the --full flag:

/agent security-reviewer --full

This executes analysis commands across all directories, aggregates findings per file, and presents a severity-ordered summary table.

Practical Usage Examples

Reviewing a New API Endpoint

After adding a payment processing route, invoke the agent to validate the implementation:

User: I just added POST /api/payments. Run a security review.
Claude Code: /agent security-reviewer

The agent executes:

• npm audit --audit-level=high
• npx eslint . --plugin security
• Pattern searches in src/app/api/payments/route.ts for hard-coded secrets, unsanitized URLs, and missing authentication checks

Results include direct links to specific lines requiring attention.

Applying Remediation Suggestions

When the agent identifies an issue, it provides actionable fixes. For example:

Issue: Hard-coded secret found in src/lib/config.ts (L42).
Fix: Replace const API_KEY = "sk_test_12345" with process.env.API_KEY.

Apply the correction using Claude Code's edit functionality:

/edit src/lib/config.ts
Old: const API_KEY = "sk_test_12345"
New: const API_KEY = process.env.API_KEY!

After editing, re-run /agent security-reviewer to verify the vulnerability is resolved and the success metrics (lines 96-100) indicate no critical issues remain.

Key Configuration Files

The security-reviewer agent relies on these specific files in the affaan-m/everything-claude-code repository:

• agents/security-reviewer.md – Contains the complete agent metadata, workflow definition, OWASP checklist (lines 34-45), pattern-rule table (lines 49-60), and success metrics (lines 96-100).

• skills/security-review/SKILL.md – Provides general security-review guidelines that the agent references for deeper analysis context.

• package.json – Defines the eslint-plugin-security dependency and npm scripts required for the agent's static analysis capabilities.

Summary

• The security-reviewer agent operates from agents/security-reviewer.md to provide automated vulnerability scanning within Claude Code.
• It validates code against the OWASP Top 10 using a structured checklist (lines 34-45) and pattern matching (lines 49-60).
• Invoke the agent using /agent security-reviewer for targeted scans or /agent security-reviewer --full for repository-wide audits.
• The agent executes sandboxed commands including npm audit and eslint-plugin-security to detect dependency and code-level vulnerabilities.
• Remediation guidance (lines 81-86) provides immediate fix suggestions with direct links to affected source lines.

Frequently Asked Questions

How does the security-reviewer agent identify specific vulnerabilities?

The agent combines static analysis tools with structured pattern matching. It executes npm audit for dependency vulnerabilities and eslint-plugin-security for code-level issues, then applies the OWASP checklist (lines 34-45) and pattern-rule table (lines 49-60) from agents/security-reviewer.md using Grep and Glob searches to locate hard-coded secrets, injection risks, and authentication flaws.

When should I trigger a security review in Claude Code?

Invoke the security-reviewer agent immediately after modifying code involving user input handling, authentication mechanisms, API endpoints, payment processing, or configuration files containing secrets. Claude Code automatically suggests the agent when your chat context includes security-related keywords, but you can manually request reviews using /agent security-reviewer whenever you need validation.

What happens if the agent finds critical vulnerabilities?

When the agent detects critical issues, it references remediation guidance (lines 81-86) to generate specific fix instructions, including the exact file path and line number. The agent reports findings with GitHub links to the problematic code and waits for you to apply fixes. Success metrics (lines 96-100) require zero critical issues and completed checklist validation before the review is considered complete.

Can I use the security-reviewer agent with non-JavaScript codebases?

The agent's current implementation in affaan-m/everything-claude-code utilizes JavaScript-specific tools like npm audit and eslint-plugin-security, but the architectural pattern supports extension. The OWASP checklist (lines 34-45) and pattern matching logic operate independently of language, though you would need to configure additional static analysis tools in the agent definition for Python, Go, or other languages.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}