AI Code Security Review

AI生成コードをリリース前にOWASP Top 10でチェック。

AIエージェントが書いたコードのためのセキュリティレビュー・チェックリスト。OWASP Top 10の失敗ポイントを押さえ、頻出の見落とし——まずはXSS——を重点的に。Veracodeの2025年調査でAI生成コードの約45%にOWASP Top 10の脆弱性があったという結果が裏付け。

こんな方におすすめ

AI支援で書いたコードをリリースする開発者とレビュアー

所要時間

プルリクエスト1件につき20分

レベル

中級

3ステップでインストール

登録不要。CLIツールも不要です。お使いのAIを選んで、1行コピーして貼るだけです。

Pro — 全531件のスキル

ご自分で入れたい場合は、スキルを購入（$4.99）し、購入完了画面からZIPをダウンロードして、上のディレクトリに展開し、AIのセッションを再起動してください。結果は同じです。すでに購入済みの場合は、AIアシスタントにダウンロードしてもらうこともできます。

パックの内容

SKILL.md（手順書）1点とスターターテンプレート1点が入っています。プレビューはこちらです：

AI Code Security Review

The idea in one paragraph

AI coding agents write plausible code fast — and plausibility is not safety. Veracode's 2025 report found roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, with cross-site scripting failing in 86% of cases tested. This skill turns that warning into a review routine: a checklist that walks every AI-generated diff through the OWASP Top 10 failure points, starting with the ones agents miss most, before the code reaches production.

What it is built on

Veracode's 2025 report: roughly 45% of AI-generated code contained OWASP Top 10 vulnerabilities, and XSS had an 86% failure rate (cited via Imran Khan's November 2026 essay on Medium).
METR research: developers using AI tools took 19% longer on tasks while self-estimating they were 20% faster (same essay) — a reminder that speed claims need evidence.
The essay's broader argument: the industry is moving from open-ended vibe coding to spec-driven development (AWS Kiro, July 2025; GitHub Spec Kit, September 2025), partly in response to quality and security concerns.

Workflow

Triage the diff (input: pull request -> output: risk-scored file list). Mark which files touch input handling, authentication, data access, or external calls. Review those first; cosmetic files last.
Run the injection checks (input: diff -> output: injection findings). Look for XSS (the 86% failure point per Veracode 2025), SQL injection, and command injection: every user-controlled value traced to its sink, every sink escaped or parameterized.
Check auth and access control (input: diff -> output: access findings). Verify the agent did not invent its own auth, skip authorization checks on new endpoints, or expose admin functions. New routes get new permission checks.
Review secrets and data handling (input: diff -> output: handling findings). Search for hardcoded keys, tokens in logs, and sensitive data in error messages. Agents love to log things they should not.
Confirm the fix loop (input: findings -> output: corrected code). Send each finding back with the vulnerable line and the required pattern. Re-review the fix itself — agents sometimes patch the symptom and keep the hole.
Sign off with evidence (input: corrected code -> output: review record). Record what was checked, what failed, and what was fixed, dated. The next reviewer should not have to repeat the whole pass.