Security Scanning

Claude Code: /plugin marketplace add wshobson/agents → /plugin install security-scanning@claude-code-workflows

Two agents, three commands and five skills cover security work that normally lives in separate tools: SAST configuration for Semgrep, CodeQL and SonarQube, dependency scanning with SBOM output, and threat modeling through STRIDE, attack trees and mitigation mapping. The interesting piece is the hardening command, written as an orchestrator rather than a prompt. Every step writes its result into a .security-hardening directory and the next step reads that file instead of trusting the context window. It also stops at phase checkpoints for approval and halts outright on a failed step, so a long run cannot quietly drift off the plan.