# Security Review

AI DevKit · Review code, skills, and prompts for security vulnerabilities, OWASP Top...

- Repository: https://github.com/codeaholicguy/ai-devkit (1656 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add codeaholicguy/ai-devkit --skill security-review -g -a claude-code -y`
Codex: `npx skills add codeaholicguy/ai-devkit --skill security-review -g -a codex -y`
Cursor: `npx skills add codeaholicguy/ai-devkit --skill security-review -g -a cursor -y`
Gemini CLI: `npx skills add codeaholicguy/ai-devkit --skill security-review -g -a gemini-cli -y`

## Description

AI DevKit · Review code, skills, and prompts for security vulnerabilities, OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Review

Find vulnerabilities before they ship.

## Hard Rules

- Do not dismiss a finding without evidence it is unexploitable.
- Do not commit, log, or surface secrets discovered during review, flag and recommend rotation.
- Do not modify code until the user approves a remediation plan.

## Workflow

1. **Scope**
   - Confirm target: diff, file set, module, full repo, or skill/prompt. A target can be both code and prompt.
   - Identify stack/framework, adapt the [checklist](references/checklist.md) (skip what the framework handles, add its pitfalls).
   - Trace data flow: request → middleware → handler → service → datastore → response. For prompts: input → template → LLM → tools → output.
   - Map trust boundaries, privilege levels, and threat actors.
   - Search prior findings: `npx ai-devkit@latest memory search --query "<target>" --tags "security"`

The rest: https://github.com/codeaholicguy/ai-devkit/blob/HEAD/skills/security-review/SKILL.md