Plugin

claude-security-linter

A pre-tool-use hook plugin that automatically scans code for security vulnerabilities before Claude writes it to disk. Detects eval() usage, Function constructor abuse, hardcoded API keys and secrets, Bearer tokens, AWS credentials, innerHTML/outerHTML XSS vectors, inline private keys, and GitHub personal access tokens. Uses a two-tier severity system: errors block the write with detailed remediation guidance, while warnings allow the write but inject advisory context. Runs as pure Node.js wi...

• Published source
• Repository

Analysed

11 October 2026

Last observed

12 October 2026

What the code does

• Refers to credential files Code that names files such as SSH keys or cloud credentials.
• Evaluates code at runtime Code that builds and runs code while it executes.
• Runs hooks automatically Hooks that execute without being called explicitly.

Having a capability is not wrongdoing; many tools need these to do their job. It tells you what to check before you install.

This is public metadata, not a safety certification or complete assessment. Static analysis cannot establish what a tool does at runtime.