security-review
AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.
Profile →npx skills add codeaholicguy/ai-devkit --skill security-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Review Find vulnerabilities before they ship. ## Hard Rules - Do not dismiss a finding without evidence it is unexploitable. - Do not commit, log, or surface secrets discovered during review — flag and recommend rotation. - Do not modify code until the user approves a remediation plan. ## Workflow 1. **Scope** - Confirm target: diff, file set, module, full repo, or skill/prompt. A target can be both code and prompt. - Identify stack/framework — adapt the [checklist](references/checklist.md) (skip what the framework handles, add its pitfalls). - Trace data flow: request → middleware → handler → service → datastore → response. For prompts: input → template → LLM → tools → output. - Map trust boundaries, privilege levels, and threat actors. - Search prior findings: `npx ai-devkit@latest memory search --query "<target>" --tags "security"` 2. **Scan** - Only check relevant categories. Skip sections and items that don't apply. Do not report skipped items. - For diffs/PRs: also check whether the change weakens existing controls — removed middleware, bypassed validation, new unprotected routes. - Categories in priority order: a. **Secrets** — hardcoded tokens, keys, connection s
- Hard Rules
- Workflow
- Red Flags
- Output Template
What does the security-review skill do?
AI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.
How do I install it?
Run `npx skills add codeaholicguy/ai-devkit --skill security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From codeaholicguy/ai-devkit, a repository with 1,572 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.