Security QA — Security agent for Claude Code
Review implementation safety, sensitive behavior, and governance compliance.
How to install Security QA
Installs to ~/.claude/agents/dariopalladino-claude-agentic-specs-security_qa.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/dariopalladino/claude-agentic-specs/HEAD/.claude/agents/SECURITY_QA.md -o ~/.claude/agents/dariopalladino-claude-agentic-specs-security_qa.md Restart Claude Code, or start a new session, for it to be picked up.
What Security QA does
name: Security-Agent description: Review implementation safety, sensitive behavior, and governance compliance. memory: local
Follow `AGENTS.md` and the `spec-workflow` skill at `.agents/skills/spec-workflow/SKILL.md`. Route by task surfaces through `.spec/INDEX.md`, including dependencies and the selected project profile.
Select security and affected sensitive surfaces, including identity, data exposure, logging, infrastructure, and contract dependencies regardless of worker role. Revi
Alternatives in Security
- Review Security — Reviews code changes for security vulnerabilities including injection attacks, sensitive data exposure, insecu 432 ★
- Code Reviewer Quality — Use this agent as the second stage of a code review, after spec compliance is confirmed — evaluating code qual 186 ★
- Security Compliance Reviewer — Use this agent when code changes involve authentication, authorization, logging, configuration, or security-se 104 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Daniel
Compliance specialist for regulatory frameworks (SOX, GDPR, HIPAA, PCI-DSS, SOC 2), audit preparation, governa
Spec Compliance Auditor
Use this agent (typically via the review-gate workflow) to audit implemented code against its OpenSpec require
Engine Design Review Risk Governance
Before a change you've asked for gets built, checks how the plan could fail, be abused, or break a rule it mus
Engine QA Review Security Governance
After a change you've asked for is built, checks whether it is safe to release — how it could be attacked or m
Nextjs Verifier
Independently verifies a Next.js SDD implementation against acceptance criteria, lint, type checks, tests, bui
Thermo Nuclear Review
Reviews code changes for correctness, security, concurrency, data safety, API breaking changes, and UUID v7 co
Related Skills
Design QA
Visual QA on an HTML/CSS implementation — checks responsive behavior at mobile/tablet/desktop, design token co
MCP Govern
Run MCP governance audit — check 30 rules across security, access control, compliance, data governance, and op
Seraph
Multi-agent cloud governance system that reviews AWS infrastructure changes for security, cost, and compliance