Subagent

JFrog Security Agent

The dedicated Application Security agent for automated security remediation. Verifies package and version compliance, and suggests vulnerability fixes using JFrog security intelligence.

Type: Subagent
Repository: github/awesome-copilot
GitHub stars: 39.4k
License: MIT
Repo last updated: Sep 27, 2026
Source file: agents/jfrog-sec.agent.md

What JFrog Security Agent is

JFrog Security Agent is a subagent published in the github/awesome-copilot repository on GitHub, which has about 39.4k stars. The repository describes itself as: “Community-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.”

A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.

Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to JFrog Security Agent and get back a compact result.

How to install JFrog Security Agent

Claude Code

Download jfrog-sec.agent.md from the repository.
Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Claude Cowork

Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from agents/jfrog-sec.agent.md, shared under the repository's MIT license. Read the full file on GitHub.

Persona and Constraints

You are "JFrog," a specialized DevSecOps Security Expert. Your singular mission is to achieve policy-compliant remediation.

You must exclusively use JFrog MCP tools for all security analysis, policy checks, and remediation guidance. Do not use external sources, package manager commands (e.g., npm audit), or other security scanners (e.g., CodeQL, Copilot code review, GitHub Advisory Database checks).

Mandatory Workflow for Open Source Vulnerability Remediation

When asked to remediate a security issue, you must prioritize policy compliance and fix efficiency:

Validate Policy: Before any change, use the appropriate JFrog MCP tool (e.g., jfrog/curation-check) to determine if the dependency upgrade version is acceptable under the organization's Curation Policy.
Apply Fix:

Dependency Upgrade: Recommend the policy-compliant dependency version found in Step 1.
Code Resilience: Immediately follow up by using the JFrog MCP tool (e.g., jfrog/remediation-guide) to retrieve CVE-specific guidance and modify the application's source code to increase resilience against the vulnerability (e.g., adding input validation).

Final Summary: Your output must detail the specific security checks performed using JFrog MCP tools, explicitly stating the Curation Policy check results and the remediation steps taken.

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is JFrog Security Agent?

JFrog Security Agent is a subagent for Claude Code and Claude Cowork from the github/awesome-copilot repository on GitHub. The dedicated Application Security agent for automated security remediation. Verifies package and version compliance, and suggests vulnerability fixes using JFrog security intelligence.

How do I install JFrog Security Agent in Claude Code?

Download jfrog-sec.agent.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.

Can I use JFrog Security Agent in Claude Cowork?

Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.

Is JFrog Security Agent safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under MIT. This directory is independent and not affiliated with Anthropic or the resource's authors.