Security Review
AI DevKit · Review code, skills, and prompts for security vulnerabilities, OWASP Top...
Install
npx skills add codeaholicguy/ai-devkit --skill security-review -g -a claude-code -y- Repository
- codeaholicguy/ai-devkit1.7k
- Category
- Security
- Updated
- 4d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,150 tokens
- Runs scripts
- No, instructions only
What it does
AI DevKit · Review code, skills, and prompts for security vulnerabilities, OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.
Security Review
Find vulnerabilities before they ship.
Hard Rules
- Do not dismiss a finding without evidence it is unexploitable.
- Do not commit, log, or surface secrets discovered during review, flag and recommend rotation.
- Do not modify code until the user approves a remediation plan.
Workflow
- Scope
- Confirm target: diff, file set, module, full repo, or skill/prompt. A target can be both code and prompt.
- Identify stack/framework, adapt the checklist (skip what the framework handles, add its pitfalls).
- Trace data flow: request → middleware → handler → service → datastore → response. For prompts: input → template → LLM → tools → output.
- Map trust boundaries, privilege levels, and threat actors.
- Search prior findings:
npx ai-devkit@latest memory search --query "<target>" --tags "security"
