AI Code Security Review
Passez le code généré par IA au crible de l'OWASP Top 10 avant sa mise en production.
Une checklist de revue de sécurité pour le code écrit par des agents IA : les points de défaillance de l'OWASP Top 10, avec une attention particulière aux ratés les plus fréquents — XSS en tête — étayée par la constatation 2025 de Veracode : environ 45 % du code généré par IA présentait des vulnérabilités de l'OWASP Top 10.
Installez-la en 3 étapes
Sans inscription. Sans outils en ligne de commande. Choisissez votre IA, copiez une ligne, collez-la.
Vous préférez le faire vous-même ? Achetez la compétence ($4.99), téléchargez le ZIP depuis votre confirmation d'achat, décompressez-le dans le répertoire indiqué ci-dessus, redémarrez votre session IA — même résultat. Vous l'avez déjà achetée ? Votre assistant IA peut la télécharger pour vous.
Contenu du pack
Un fichier SKILL.md (le guide pratique) + un modèle de départ. Aperçu :
AI Code Security Review
The idea in one paragraph
AI coding agents write plausible code fast — and plausibility is not safety. Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with cross-site scripting failing in 86% of cases tested. This skill turns that warning into a review routine: a checklist that walks every AI-generated diff through the OWASP Top 10 failure points, starting with the ones agents miss most, before the code reaches production.
What it is built on
- Veracode's 2025 report: roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, and XSS had an 86% failure rate (cited via Imran Khan's November 2026 essay on Medium).
- METR research: developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster (same essay) — a reminder that speed claims need evidence.
- The essay's broader argument: the industry is moving from open-ended vibe coding to spec-driven development (AWS Kiro, July 2025; GitHub Spec Kit, September 2025), partly in response to quality and security concerns.
Workflow
- Triage the diff (input: pull request -> output: risk-scored file list). Mark which files touch input handling, authentication, data access, or external calls. Review those first; cosmetic files last.
- Run the injection checks (input: diff -> output: injection findings). Look for XSS (the 86% failure point per Veracode 2025), SQL injection, and command injection: every user-controlled value traced to its sink, every sink escaped or parameterized.
- Check auth and access control (input: diff -> output: access findings). Verify the agent did not invent its own auth, skip authorization checks on new endpoints, or expose admin functions. New routes get new permission checks.
- Review secrets and data handling (input: diff -> output: handling findings). Search for hardcoded keys, tokens in logs, and sensitive data in error messages. Agents love to log things they should not.
- Confirm the fix loop (input: findings -> output: corrected code). Send each finding back with the vulnerable line and the required pattern. Re-review the fix itself — agents sometimes patch the symptom and keep the hole.
- Sign off with evidence (input: corrected code -> output: review record). Record what was checked, what failed, and what was fixed, dated. The next reviewer should not have to repeat the whole pass.
What good looks like
Aperçu du modèle
AI Code Security Review Sheet
PR / commit: Reviewer: Date:
Triage — files by risk
OWASP Top 10 pass
Findings and fixes
Sign-off: _I reviewed this AI-generated diff against the checklist above._
Le pack de compétence lui-même (SKILL.md + modèle) est rédigé en anglais.
