secdevai-review

Analyze source code against OWASP Top 10 and WSTG patterns for security vulnerabilities.

8|8|Updated Dec 14, 2025

Search Tags:#code review #security #vulnerability #owasp #ai #wstg

Ready to run

npx skills add https://github.com/RedHatProductSecurity/secdevai --skill secdevai-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secdevai-review
Source: https://github.com/RedHatProductSecurity/secdevai/tree/main/lola-module/skills/secdevai-review
Command: npx skills add https://github.com/RedHatProductSecurity/secdevai --skill secdevai-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the identification of security vulnerabilities within source code, helping developers proactively address risks before deployment.

Core Features & Use Cases

AI-Powered Security Review: Analyzes code against OWASP Top 10 and WSTG patterns.
Multi-Language Support: Adapts analysis for various programming languages.
Contextual Analysis: Integrates with specific security contexts (web, Go, OCI).
Use Case: When committing code, run /secdevai review last-commit to automatically scan recent changes for potential security flaws and receive immediate feedback.

Quick Start

Run the secdevai review skill on the last commit to scan for security vulnerabilities.

Frequently Asked Questions about secdevai-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my recent git commits for security vulnerabilities?▼

To scan recent git commits for security vulnerabilities, run an AI-powered security review targeting the last commit. This analyzes your code changes against OWASP Top 10 and WSTG patterns to classify risks and suggest remediations for identified flaws.

What is an AI-powered security code review and how does it work?▼

An AI-powered security code review analyzes source code against OWASP Top 10 and WSTG patterns. It identifies vulnerabilities across multiple languages, classifies findings by severity, and provides actionable remediation suggestions for your codebase.

Can I analyze specific files or an entire codebase for OWASP Top 10 risks?▼

Yes, you can analyze specific files, entire codebases, or git commits for OWASP Top 10 risks. The review adapts its analysis for various programming languages and integrates specific security contexts like web or OCI.

Does the security vulnerability analysis support multiple programming languages?▼

Yes, the security vulnerability analysis supports multiple programming languages. It adapts its OWASP and WSTG pattern matching based on the specific language and context of the source code being reviewed.

How are security findings from the code review classified?▼

Security findings from the code review are classified by severity. After analyzing the source code for vulnerabilities, the tool provides tailored remediation suggestions to help developers proactively address the identified risks.