MaverickHQ

Valvur — Security skill for Claude Code

Security community

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command.

How to install Valvur

This entry records only its repository, not the path inside it, so there is no exact command to give. Open MaverickHQ/valvur and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Valvur does

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious dependencies, poisoned agent configuration, and infrastructure and code flaws. An MCP server for Claude Code and Kiro, and a CLI. Your source never leaves your machine.

Alternatives in Security

Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★
Security Scan Report — Generated: 2026-04-10 20:48 UTC Skills scanned: 134 Total findings: 836 Critical: 32 High: 50 Safe skills: 100 18.1k ★
Security Best Practices — Review code for language-specific security vulnerabilities 14.6k ★

README

**Offline security scanning for AI-generated code.**
Seven open-source scanners and AI-specific checks, in one command and one ranked report.

[![PyPI](https://img.shields.io/pypi/v/valvur)](https://pypi.org/project/valvur/) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue)](https://pypi.org/project/valvur/) [![CI](https://github.com/MaverickHQ/valvur/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/MaverickHQ/valvur/actions/workflows/ci.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/MaverickHQ/valvur/badge)](https://scorecard.dev/viewer/?uri=github.com/MaverickHQ/valvur) [![Licence: Apache-2.0](https://img.shields.io/badge/licence-Apache--2.0-blue)](LICENSE)
Scorecard's Code-Review, Branch-Protection and Contributors checks need a second maintainer; valvur has one ([MAINTAINERS.md](MAINTAINERS.md)).

**Status: `1.5.1`**, the version this tree declares; the PyPI badge above shows what `pip install valvur` serves, and [the CHANGELOG](CHANGELOG.md) what each version changed.

**In Claude Code:** `/plugin marketplace add MaverickHQ/valvur`, then `/plugin install valvur@valvur`, and ask it to scan the project.
**From a terminal,** with Docker or Podman running: `uvx valvur scan`.

![valvur scans a project whose lockfile pins a package published as malicious, and lists the findings](docs/demo.svg)

Why valvur

Seven scanners, one report. Gitleaks, Trivy, OSV-Scanner, Opengrep, Checkov, zizmor and Syft, pinned, installed and run for you in one container, beside valvur's own checks for AI-written code. A vulnerability two of them report is one finding, not two, and everything is ranked together.
Nothing leaves your machine, provably. No account, no API key, no telemetry. The Scanne