AI Code Security Review
Revisa el código generado por IA contra el OWASP Top 10 antes de lanzarlo.
Una lista de revisión de seguridad para código escrito por agentes IA: los puntos de fallo del OWASP Top 10, con atención extra a los errores más frecuentes — XSS primero — respaldada por el hallazgo 2025 de Veracode: cerca del 45% del código generado por IA contenía vulnerabilidades OWASP Top 10.
Instálala en 3 pasos
Sin registro. Sin herramientas CLI. Elige tu IA, copia una línea y pégala.
¿Prefieres hacerlo tú mismo? Compra la habilidad ($4.99), descarga el ZIP desde la confirmación de compra, descomprímelo en el directorio que se muestra arriba y reinicia tu sesión de IA — el mismo resultado. ¿Ya la compraste? Tu asistente de IA puede descargarla por ti.
Qué incluye
Un SKILL.md (la guía paso a paso) + una plantilla inicial. Una vista previa:
AI Code Security Review
The idea in one paragraph
AI coding agents write plausible code fast — and plausibility is not safety. Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with cross-site scripting failing in 86% of cases tested. This skill turns that warning into a review routine: a checklist that walks every AI-generated diff through the OWASP Top 10 failure points, starting with the ones agents miss most, before the code reaches production.
What it is built on
- Veracode's 2025 report: roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, and XSS had an 86% failure rate (cited via Imran Khan's November 2026 essay on Medium).
- METR research: developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster (same essay) — a reminder that speed claims need evidence.
- The essay's broader argument: the industry is moving from open-ended vibe coding to spec-driven development (AWS Kiro, July 2025; GitHub Spec Kit, September 2025), partly in response to quality and security concerns.
Workflow
- Triage the diff (input: pull request -> output: risk-scored file list). Mark which files touch input handling, authentication, data access, or external calls. Review those first; cosmetic files last.
- Run the injection checks (input: diff -> output: injection findings). Look for XSS (the 86% failure point per Veracode 2025), SQL injection, and command injection: every user-controlled value traced to its sink, every sink escaped or parameterized.
- Check auth and access control (input: diff -> output: access findings). Verify the agent did not invent its own auth, skip authorization checks on new endpoints, or expose admin functions. New routes get new permission checks.
- Review secrets and data handling (input: diff -> output: handling findings). Search for hardcoded keys, tokens in logs, and sensitive data in error messages. Agents love to log things they should not.
- Confirm the fix loop (input: findings -> output: corrected code). Send each finding back with the vulnerable line and the required pattern. Re-review the fix itself — agents sometimes patch the symptom and keep the hole.
- Sign off with evidence (input: corrected code -> output: review record). Record what was checked, what failed, and what was fixed, dated. The next reviewer should not have to repeat the whole pass.
What good looks like
Vista previa de la plantilla
AI Code Security Review Sheet
PR / commit: Reviewer: Date:
Triage — files by risk
OWASP Top 10 pass
Findings and fixes
Sign-off: _I reviewed this AI-generated diff against the checklist above._
El paquete de la habilidad (SKILL.md + plantilla) está escrito en inglés.
