Sparc Security Review

What Sparc Security Review is

Sparc Security Review is a slash command published in the ruvnet/agentic-flow repository on GitHub, which has about 813 stars. The repository describes itself as: “Easily switch between alternative low-cost AI models in Claude Code/Agent SDK. For those comfortable using Claude agents and commands, it lets you take what you've created and deploy fully hosted agents for real business purposes. Use Claude Code to get the agent working, then deploy it in your favorite cloud.”

A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.

Sparc Security Review gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.

How to install Sparc Security Review

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

The repository does not declare an open-source license, so we list only the outline of the file here. Read the full text on GitHub.

• Role Definition
• Custom Instructions
• Available Tools
• Usage
• Option 1: Using MCP Tools (Preferred in Claude Code)
• Option 2: Using NPX CLI (Fallback when MCP not available)
• Option 3: Local Installation
• Memory Integration
• Using MCP Tools (Preferred)
• Using NPX CLI (Fallback)

Open security-review.md on GitHub

Before you install

• Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
• Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
• Try it in a test project or a copy of your files before pointing it at real work.
• Pin the version you tested, and review changes before updating.
• Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ