AI Code Security Review
Passa il codice generato dall'AI al vaglio dell'OWASP Top 10 prima del rilascio.
Una checklist di security review per il codice scritto da agenti AI: i punti critici dell'OWASP Top 10, con attenzione speciale alle mancanze più frequenti — XSS per primo — sostenuta dal dato Veracode 2025: circa il 45% del codice generato dall'AI presentava vulnerabilità OWASP Top 10.
Installala in 3 passaggi
Nessuna registrazione. Nessuno strumento da riga di comando. Scegli la tua AI, copia una riga e incollala.
Preferisci fare da te? Acquista la skill ($4.99), scarica lo ZIP dalla conferma d'acquisto, decomprimilo nella cartella mostrata sopra e riavvia la sessione della tua AI — stesso risultato. L'hai già acquistata? Il tuo assistente AI può scaricarla per te.
Cosa contiene
Un file SKILL.md (la guida operativa) + un modello di partenza. Un'anteprima:
AI Code Security Review
The idea in one paragraph
AI coding agents write plausible code fast — and plausibility is not safety. Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with cross-site scripting failing in 86% of cases tested. This skill turns that warning into a review routine: a checklist that walks every AI-generated diff through the OWASP Top 10 failure points, starting with the ones agents miss most, before the code reaches production.
What it is built on
- Veracode's 2025 report: roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, and XSS had an 86% failure rate (cited via Imran Khan's November 2026 essay on Medium).
- METR research: developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster (same essay) — a reminder that speed claims need evidence.
- The essay's broader argument: the industry is moving from open-ended vibe coding to spec-driven development (AWS Kiro, July 2025; GitHub Spec Kit, September 2025), partly in response to quality and security concerns.
Workflow
- Triage the diff (input: pull request -> output: risk-scored file list). Mark which files touch input handling, authentication, data access, or external calls. Review those first; cosmetic files last.
- Run the injection checks (input: diff -> output: injection findings). Look for XSS (the 86% failure point per Veracode 2025), SQL injection, and command injection: every user-controlled value traced to its sink, every sink escaped or parameterized.
- Check auth and access control (input: diff -> output: access findings). Verify the agent did not invent its own auth, skip authorization checks on new endpoints, or expose admin functions. New routes get new permission checks.
- Review secrets and data handling (input: diff -> output: handling findings). Search for hardcoded keys, tokens in logs, and sensitive data in error messages. Agents love to log things they should not.
- Confirm the fix loop (input: findings -> output: corrected code). Send each finding back with the vulnerable line and the required pattern. Re-review the fix itself — agents sometimes patch the symptom and keep the hole.
- Sign off with evidence (input: corrected code -> output: review record). Record what was checked, what failed, and what was fixed, dated. The next reviewer should not have to repeat the whole pass.
What good looks like
Anteprima del modello
AI Code Security Review Sheet
PR / commit: Reviewer: Date:
Triage — files by risk
OWASP Top 10 pass
Findings and fixes
Sign-off: _I reviewed this AI-generated diff against the checklist above._
Il pacchetto della skill (SKILL.md + modello) è scritto in inglese.
