From ai-devkit
Reviews code, skills, and prompts for security vulnerabilities covering OWASP Top 10, prompt injection, business logic flaws. Use for PRs, audits, or pre-release reviews.
How this skill is triggered — by the user, by Claude, or both
Slash command
/ai-devkit:security-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Find vulnerabilities before they ship.
Find vulnerabilities before they ship.
Scope
npx ai-devkit@latest memory search --query "<target>" --tags "security"Scan
Classify
| Severity | Criteria |
|---|---|
| Critical | Exploitable now, data loss or RCE possible |
| High | Exploitable with moderate effort or insider access |
| Medium | Requires chained conditions or limited impact |
| Low | Defense-in-depth, no direct exploit path |
Remediate
Verify
verify skill to confirm each remediation.npx ai-devkit@latest memory store --title "<pattern>" --content "<finding and fix>" --tags "security,<category>"| Rationalization | Do Instead |
|---|---|
| "It's internal / behind a VPN / only admins" | Zero-trust: validate at every boundary regardless of network position or user role |
| "We'll add auth later" | Add auth before merge — unauthenticated endpoints get discovered fast |
| "It's just a dev credential" | Use env vars / secrets manager — dev secrets leak to prod constantly |
| "The framework handles that" | Verify the config — frameworks have defaults, not guarantees |
| "We sanitize on the frontend" | Always validate server-side — client validation is bypassable |
| "The LLM won't follow injected instructions" | Treat all tool results and external content as untrusted data |
| "It's just a prompt, not code" | Prompts control tool execution — review with the same rigor as code |
npx claudepluginhub codeaholicguy/ai-devkitPerforms systematic security code review for vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues. Reports only high-confidence exploitable findings after tracing data flow and checking framework protections.
Audits code for security vulnerabilities including OWASP Top 10, auth flaws, injection, data exposure, and dependency risks using STRIDE threat modeling and phased reviews.
Scans codebases for OWASP Top 10 vulnerabilities via static analysis: secret exposure, injection flaws, auth/authz gaps, supply-chain risks, misconfigurations, logging failures. Use before deployments, PR merges, auth/payment changes.