Host guide · Claude Code

Run an evidence-first security audit inside Claude Code.

Install SecHelix in Claude Code as a plugin, a marketplace entry, or a project skill, then run a scoped audit that verifies its own findings before reporting them. Plugin load is verified; the project-skill path is documented.

Part of the AppSec agent guide.

A security skill for Claude Code is a set of files Claude loads at session start that replaces improvised review with a contract. SecHelix is one: install it with /plugin install sechelix@sechelix, with claude --plugin-dir, or with the Agent Skills CLI, then ask for an audit in plain language. The session gains a review lifecycle, 17 specialist role profiles, a 546-item hypothesis catalog, and a rule that no High or Critical candidate is reported until a second pass has tried to refute it.

The practical difference is what Claude refuses to say. Without a contract, a model asked to find vulnerabilities produces a list. With one, it produces a list plus an explicit applicability verdict, an evidence chain per candidate, a set of refutations, and a release decision that can come back INCOMPLETE rather than green. The published run shows both halves of that: one candidate that survived verification, and two that did not.

Plugin load verifiedProject skill documentedWorkflow benchmark not measured

Three install paths, and what each one actually does

All three end with the same methodology loaded. They differ in what gets copied and who maintains it.

Claude plugin marketplace

/plugin marketplace add omarmohelal/sechelix-marketplace
/plugin install sechelix@sechelix

The marketplace entry is the shortest path for a team: one command adds the source, the second installs the plugin by name. The plugin manifest declares the skill, the specialist agents, and the version, so everyone on the team loads the same revision.

Local plugin directory

git clone https://github.com/omarmohelal/SecHelix.git
claude --plugin-dir ./SecHelix

Pointing Claude at a clone of the repository is the path to use when you want to read the catalog, the schemas, and the Gold Check Packs while you work. It is also the configuration whose load is recorded as verified: claude plugin validate . passes, and plugin details sechelix reports one skill and the specialist agents.

Project-local skill

mkdir -p .claude/skills
cp -R SecHelix/skills/sechelix .claude/skills/sechelix

Copying the portable bundle into .claude/skills/sechelix/ pins the methodology to one repository and commits it alongside the code it reviews. This is the documented Claude Code discovery path. It is documented rather than verified here, which is a statement about our test records, not about whether it works for you.

The cross-client installer is the fourth option and the one to use if you also work in other hosts.

What changes inside the session

The Claude-specific adapter does not fork the methodology. It adds orchestration guidance on top of the canonical workflow, and the canonical workflow is the only place severity rules, the safety policy, and the evidence standard are defined.

Subagents are used for disjoint review lanes, not for the same lane twice. Two agents reviewing the same file and agreeing is duplication, not corroboration.
A High or Critical candidate spawns an independent verifier that is asked to refute the finding rather than confirm it. It receives the claim without the hunter narrative and without the desired verdict.
Applicability is decided before testing. Every catalog hypothesis is labelled APPLICABLE, NOT_APPLICABLE, UNKNOWN, or BLOCKED, and UNKNOWN is never quietly folded into NOT_APPLICABLE.
Execution mode is recorded in the scope record before any traffic is generated. With no mode specified the run starts STATIC.

The first run

Ask for the audit in the session. There is no separate binary to invoke and no configuration file to write first.

Session prompt

Use SecHelix for a complete authorized security audit of this repository.
Start STATIC, map the attack surface and trust boundaries, evaluate only applicable hypotheses,
independently verify High/Critical candidates, fix root causes, add regression proof, retest,
and produce the final release gate.

Scoping the request narrows the run usefully. Naming a diff turns it into a pull-request review; naming an authorization concern loads the role by object by action matrix; naming a payment flow loads the state-machine lane. A narrower run finishes with more evidence per claim, which is the trade you want.

Starting mode: STATIC
Escalation: LOCAL and STAGING require recorded authorization in the scope record.
Verification: Required for every High and Critical candidate before final reporting.
Valid outcomes: VERIFIED, LIKELY_BUT_UNPROVEN, FALSE_POSITIVE, DUPLICATE_ROOT_CAUSE, BLOCKED_BY_ENVIRONMENT
Release decisions: PASS, PASS_WITH_KNOWN_RISK, BLOCKED, INCOMPLETE

Confirm the skill actually loaded

A skill that silently failed to load looks identical to one that loaded and had nothing to say. Two checks separate those cases.

Plugin validation

claude plugin validate .
claude --plugin-dir . plugin details sechelix

Then ask the session to state the four execution modes and the four release outcomes back to you. Both lists live in the skill file. A correct answer costs one turn and rules out a loader problem before you spend an audit on it.

Where Claude Code support is verified, and where it is not

Claude Code plugin

VERIFIED

claude plugin validate . passes and --plugin-dir loads the skill and the specialist agents at the declared version.

Agent Skills CLI

VERIFIED

Cold-installed into an empty project. It writes .agents/skills/sechelix/ and links .claude/skills/sechelix.

Project skill file

DOCUMENTED

.claude/skills/sechelix/SKILL.md is the documented discovery path. A Claude Code session loading it was not observed and recorded.

Portable bundle

VERIFIED

Copied out of the repository to a scratch directory; five entry points ran from inside the copy with no parent-directory access.

Claim	Status
Plugin manifest loads in Claude Code	Verified on a recorded date and host
Skill improves finding accuracy	NOT_MEASURED
Skill reduces false positives	NOT_MEASURED
Findings require independent verification	Enforced by the contract

Two packaging details worth knowing before you install. The Agent Skills CLI matches the root skill file and copies the whole repository tree — tests, evaluation fixtures, and documentation included — into the skill directory. The hand-copied portable bundle is the minimal one. Both work; only the second is small.

Separately, the plugin loads the agents directory README as an additional agent entry, so the reported agent count is one higher than the number of specialist roles. It is cosmetic, and it is recorded rather than hidden.

Nothing here is a performance claim. One uncontaminated blind label-only run exists (precision 0.950, detection recall 1.000, FP rate 0.053 on 76 authored cases). It measured one label per file and did not run the independent verifier, the adapters, remediation, regression proof or the release gate, so full-workflow performance remains NOT_MEASURED.

Install

One command, then ask for the audit.

npx skills@latest add omarmohelal/SecHelix --skill sechelix

InstallationEvery host path and the four-value compatibility matrix.DocumentationThe full contract: evidence standard, applicability, release decisions.Gold Check PacksReusable investigation plans a Claude session can follow directly.Case studiesOne verified finding and one refuted high-severity candidate.SecHelix on GitHub Catalog, schemas, packs, adapters, and the plugin manifest.