Security Review

This is a structured security auditing skill that walks Claude through threat modeling, vulnerability scanning, and remediation planning for both code and AI prompts. It enforces hard rules like not dismissing findings without proof and not exposing discovered secrets, then runs through a checklist covering OWASP risks, prompt injection, and business logic flaws. The workflow is opinionated about severity classification and includes a table of developer rationalizations to push back against. What's useful here is the dual focus on traditional app security and LLM-specific attacks, treating prompts as code that controls tool execution. Good for pre-commit reviews or release audits when you want consistent coverage without the false negatives that come from ad-hoc security questions.

GitHub stars: 1.3K
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add codeaholicguy/ai-devkit --skill security-review --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Review

Find vulnerabilities before they ship.

Hard Rules

Do not dismiss a finding without evidence it is unexploitable.
Do not commit, log, or surface secrets discovered during review — flag and recommend rotation.
Do not modify code until the user approves a remediation plan.

Workflow

Scope
- Confirm target: diff, file set, module, full repo, or skill/prompt. A target can be both code and prompt.
- Identify stack/framework — adapt the checklist (skip what the framework handles, add its pitfalls).
- Trace data flow: request → middleware → handler → service → datastore → response. For prompts: input → template → LLM → tools → output.
- Map trust boundaries, privilege levels, and threat actors.
- Search prior findings: npx ai-devkit@latest memory search --query "<target>" --tags "security"