Plugin defending-code
Security find-and-fix loop — adapted (Apache-2.0) from anthropics/defending-code-reference-harness and generalised to all vulnerability classes. Four read/write-only skills (no target-code execution): threat-model (bootstrap from code+CVEs+git-history, or interview an owner via Shostack's four questions, or both -> THREAT_MODEL.md), vuln-scan (static source review, parallel per-focus-area subagents -> VULN-FINDINGS.json), triage (adversarial N-vote verification, 16 false-positive exclusion rules, root-cause dedup, impact-on-asset x exploitability severity with stated deployment conditions, owner routing, checkpoint/resume -> TRIAGE.json), and patch (root-cause candidate diffs + independent reviewer, fix-first priority for deployment-conditional dangerous primitives, never auto-applied -> PATCHES/). The autonomous C/C++ + AddressSanitizer execution pipeline this was extracted from is referenced, not bundled (vuln-scan/HARNESS.md).
Comment installer le plugin defending-code
Exécutez les deux commandes dans Claude Code. La première ajoute la marketplace une seule fois ; la seconde installe le plugin.
/plugin marketplace add air-gapped/skills
/plugin install defending-code@air-gapped-marketplaceContenu de defending-code
10 parties lues depuis les fichiers du plugin.
Agents 6
Appeler via @agent-defending-code:name- @agent-defending-code:patch-author
Patch author for one verified vulnerability finding in a patch run. Spawn with a repo path and a nonce-tagged finding block — not for general delegation.
- @agent-defending-code:patch-reviewer
Independent reviewer for one candidate security patch in a patch run. Spawn with a repo path, location, category, and nonce-tagged diff — not for general delegation.
- @agent-defending-code:triage-ranker
Severity ranker for one confirmed triage finding. Spawn with a repo path, deployment context, and finding fields — not for general delegation.
- @agent-defending-code:triage-verifier
Adversarial verifier for one scanner finding in a triage run. Spawn with a repo path, environment, and finding block — not for general delegation.
- @agent-defending-code:vuln-area-reviewer
Static security reviewer for one focus area of a vuln-scan run. Spawn with a focus area, target dir, and scoping facts — not for general delegation.
- @agent-defending-code:vuln-confidence-scorer
Second-opinion confidence scorer for one vuln-scan finding. Spawn with a finding block and target dir — not for general delegation.
Skills 4
Claude le charge quand la tâche correspond- patch
Generates candidate security fix diffs from verified findings using static analysis or execution-verified pipelines.
- threat-model
Builds a structured threat model for a codebase using interview, bootstrap, or hybrid modes to map attack surfaces and prioritize security risks.
- triage
Triages security findings by verifying authenticity, deduplicating results, and ranking them by impact and exploitability.
- vuln-scan
Performs static source-code vulnerability scans by spawning parallel subagents to review specific focus areas and generate structured findings.
Utiliser defending-code dans Claude Code
Demandez un agent par son nom :
@agent-defending-code:patch-author
@agent-defending-code:patch-reviewerLes Skills ne nécessitent pas de commande. Claude les lit quand votre requête correspond à leur description.
Mettre à jour, désactiver ou supprimer
- Mettre à jour le plugin (shell)
- claude plugin update defending-code@air-gapped-marketplace
- Actualiser le marketplace
- /plugin marketplace update air-gapped-marketplace
- Le désactiver pour le moment
- /plugin disable defending-code@air-gapped-marketplace
- Le supprimer
- /plugin uninstall defending-code@air-gapped-marketplace
Skills dans defending-code
- patchair-gapped/skills
Generates candidate security fix diffs from verified findings using static analysis or execution-verified pipelines.
6 fichiers6étoiles - threat-modelair-gapped/skills
Builds a structured threat model for a codebase using interview, bootstrap, or hybrid modes to map attack surfaces and prioritize security risks.
9 fichiers6étoiles - triageair-gapped/skills
Triages security findings by verifying authenticity, deduplicating results, and ranking them by impact and exploitability.
12 fichiers6étoiles - vuln-scanair-gapped/skills
Performs static source-code vulnerability scans by spawning parallel subagents to review specific focus areas and generate structured findings.
5 fichiers6étoiles
Questions sur le plugin defending-code
Comment installer le plugin defending-code ?
Dans Claude Code, exécutez /plugin marketplace add air-gapped/skills, puis /plugin install defending-code@air-gapped-marketplace.
Que contient le plugin defending-code ?
defending-code regroupe 6 agents, 4 skills.
Quels agents sont inclus avec defending-code ?
patch-author, patch-reviewer, triage-ranker, triage-verifier, vuln-area-reviewer, vuln-confidence-scorer. Appelez-en un avec @agent-defending-code:patch-author.
Comment mettre à jour ou supprimer le plugin defending-code ?
Mettez-le à jour avec claude plugin update defending-code@air-gapped-marketplace dans votre shell, ou depuis l'onglet Installed de /plugin. Supprimez-le avec /plugin uninstall defending-code@air-gapped-marketplace.
Sous quelle licence est le plugin defending-code ?
MIT, comme indiqué dans le manifeste du plugin.