Documentation missing for `/security-review` slash command and its git dependency
Title: Documentation missing for /security-review slash command and its git dependency
Body:
Description
Hello Claude Code team,
I've discovered a built-in slash command, /security-review, which appears to be a very useful feature. However, it is not documented in the official Slash commands documentation.
Furthermore, this command has a hidden dependency: it only works if Claude Code is running inside a directory that is a git repository. If run in a non-git directory, it fails with a low-level git error.
This undocumented dependency can be confusing for users. I believe adding this command to the documentation, along with its prerequisites, would greatly improve the user experience.
Steps to Reproduce
Scenario 1: Command fails in a non-git repository
- Create and navigate to a new directory that is not a git repository.
``bash``
mkdir test-project && cd test-project
- Start Claude Code.
``bash``
claude
- Run the
/security-reviewcommand. - Observe the error: The command fails with a git error.
``
> /security-review
⎿ Error: Bash command failed for pattern "!": [stderr]``
fatal: not a git repository (or any of the parent directories): .git
Scenario 2: Command succeeds in a git repository
- Navigate to a directory that is an initialized git repository.
``bash``
cd /path/to/my/git-repo
- Start Claude Code.
``bash``
claude
- Run the
/security-reviewcommand. - Observe the success: The command executes as expected and begins analyzing code changes.
```
> /security-review is analyzing code changes for security risks…
⏺ I'll perform a security-focused code review of the changes...
```
Expected Behavior
- The
/security-reviewcommand should be officially documented in theen/docs/claude-code/slash-commands.mdfile. - The documentation should clearly state that the command must be run within a git repository.
- Ideally, if the command is run outside a git repository, it should return a user-friendly message (e.g., "Error: /security-review must be run inside a git repository.") instead of the raw
fatalerror.
Suggested Documentation Updates
Please update the documentation to include:
- A description of what the
/security-reviewcommand does. - Its requirement to be run inside a git repository.
- The
allowed-toolsit needs (e.g.,Bash(git status:*),Bash(git diff:*), etc.), as it appears to executegitcommands under the hood.
Thank you for creating such a powerful tool
7 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
Not sure if it should be a separate issue, but it also assume that origin/HEAD is set.
But after
git remote set-head origin mainit fixes the issue.Title: Docs: Document the built-in
/security-reviewslash commandLabels:
documentation,bugBody:
Description
The built-in slash command
/security-reviewis not documented in the official Claude Code documentation. This command is available by default with a new installation of Claude Code but is not listed among the other built-in commands.Currently, the only mention of
/security-reviewis in theen/docs/claude-code/common-workflows.mdfile, where it is incorrectly presented as an example of how to create a custom personal slash command. This is misleading for two reasons:Undocumented Behavior & Requirements
The built-in
/security-reviewcommand has the following behavior that needs to be documented:git diffto identify changes to be reviewed.Impact
Suggested Actions
en/docs/claude-code/slash-commands.md: Add an entry for/security-reviewto the "Built-in slash commands" table, including its purpose and the Git repository prerequisite.en/docs/claude-code/common-workflows.md: The section "Create personal slash commands" should be updated to use a different command name as its example (e.g.,/my-custom-review) to avoid confusion with the built-in command.common-workflows.mdthat explicitly demonstrates how to use the built-in/security-reviewcommand effectively.There are 2 websites where
/security-reviewis now mentioned (but still missing from the official docs.anthropic.com website):Posted on August 06, 2025
https://www.anthropic.com/news/automate-security-reviews-with-claude-code
Updated last week
https://support.anthropic.com/en/articles/11932705-automated-security-reviews-in-claude-code
Anthropic, please update your documentation page docs.anthropic.com with this important feature.
the /security-review command is now documented on https://code.claude.com/docs/en/slash-commands. thanks for reporting!
@catherinewu - please reopen. The requirement of
git remote set-head origin main, mentioned in https://github.com/anthropics/claude-code/issues/5268#issuecomment-3189985146, and still needed forClaude Code v2.0.55, is not documented at https://code.claude.com/docs/en/slash-commandsThis issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.