菜单
AI-powered secure development assistant. Dispatches to review, fix, tool, and export subcommands. Use when the user invokes /secdevai with no subcommand or needs an overview of available security commands.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run external security analysis tools (Bandit, Gosec, Scorecard, Semgrep) inside read-only containers via podman/docker. Use when the user wants to execute specific security tools, combine their output with AI analysis, or run all available tools at once.
Perform AI-powered security code review using OWASP Top 10, CWE/SANS Top 25, and WSTG patterns. Use when reviewing source code, specific files, git commits, or entire codebases for security vulnerabilities. Supports web and non-web code (C/C++, Go, Rust, etc.), multi-language analysis, severity classification, and automated finding validation via subagent.
Validate security findings for exploitability, severity accuracy, and CVSS scoring. Use when secdevai-review dispatches findings for validation, or when the user invokes /secdevai validate to re-validate prior results. Rejects false positives, calibrates severity to Red Hat classification, and produces per-finding CVSS v3.1 analysis.
Dynamic Application Security Testing (DAST) using RapiDAST and ZAP. Use when the user wants to scan a running web app or API for security vulnerabilities, run a DAST scan, test a service endpoint, use RapiDAST or ZAP, or says "/secdevai dast" or "/secdevai-dast". Auto-detects Dockerfile/Compose for containerized targets, finds OpenAPI specs, guides the full scan workflow from target setup through SARIF result export, and — uniquely — traces each DAST finding back to the exact source file and line that is the root cause.
Export security review results to Markdown and SARIF report formats. Use when the user wants to save, export, or generate reports from security review findings produced by /secdevai review, /secdevai fix, or /secdevai tool.
Display all available SecDevAI commands, usage examples, aliases, and configuration options. Use when the user asks for help, needs a command reference, or wants to see the typical security review workflow.
| name | secdevai |
| description | AI-powered secure development assistant. Dispatches to review, fix, tool, and export subcommands. Use when the user invokes /secdevai with no subcommand or needs an overview of available security commands. |
AI-powered secure development assistant that dispatches to specialized sub-skills. Use /secdevai with no arguments for help, or specify a subcommand.
Important: /secdevai with no arguments shows help. Use /secdevai review to perform security reviews.
/secdevai # Show help (default)
/secdevai help # Show all available commands
/secdevai review # Review selected code (if selected) or full codebase scan
/secdevai review @ file # Review specific file
/secdevai review last-commit # Review last commit
/secdevai review last-commit --number N # Review last N commits
/secdevai fix [severity high] # Apply suggested fixes (with approval, optional severity filter)
/secdevai tool bandit # Use specific tool (bandit, scorecard, all)
/secdevai dast # DAST scan web app/API using RapiDAST (auto-detects Dockerfile/OpenAPI)
/secdevai dast --url <URL> # DAST scan a specific URL (legal warning applies)
/secdevai git-commit # Commit approved fixes (requires git config and approved fixes)
/secdevai validate # Validate findings from prior review (exploitability, CVSS, severity)
/secdevai export json # Export report (json, markdown, sarif)
/secdevai oci-image-security # Analyze OCI container images for security issues
/secdevai-help # Show help (alias for /secdevai help)
/secdevai-fix # Apply suggested fixes (alias for /secdevai fix)
/secdevai-review # Review code (alias for /secdevai review)
/secdevai-report # Generate security report
/secdevai-tool # Use specific tool (alias for /secdevai tool)
/secdevai-validate # Validate findings (alias for /secdevai validate)
/secdevai-dast # DAST scan (alias for /secdevai dast)
/secdevai-export # Export report (alias for /secdevai export)
/secdevai-oci-image-security # Analyze OCI container images for security issues
When user runs /secdevai, route to the appropriate sub-skill:
No arguments / help (default):
/secdevai with no arguments should ONLY show help, NOT run reviewreview is explicitly specifiedreview: Delegate to the secdevai-review skill.
The review skill handles all security code review logic including scope detection, security context loading, OWASP/WSTG analysis, findings presentation, and result export.
fix: Delegate to the secdevai-fix skill.
The fix skill handles applying security remediation with before/after diffs, severity filtering, explicit approval, and result export.
tool: Delegate to the secdevai-tool skill.
The tool skill handles external tool execution (Bandit, Scorecard), output parsing, AI synthesis, and result export.
validate: Delegate to the secdevai-validate skill.
The validate skill checks exploitability, calibrates severity against Red Hat's classification, and produces CVSS v3.1 analysis. Typically invoked automatically by secdevai-review as a subagent, but can be run manually to re-validate prior results.
export: Delegate to the secdevai-export skill.
The export skill handles converting findings to Markdown and SARIF formats.
oci-image-security: Delegate to the secdevai-oci-image-security skill.
The OCI image security skill analyzes container images for CVE/package vulnerabilities, configuration security issues, supply chain risks, and hardening gaps. Use when reviewing Dockerfiles, Containerfiles, or OCI images from any registry.
dast: Delegate to the secdevai-dast skill.
The DAST skill performs dynamic application security testing using RapiDAST. It auto-detects Dockerfile/Compose for container setup, discovers OpenAPI specs, handles authentication, runs passive then optionally active scanning, and exports SARIF results. Crucially, it also traces each DAST finding back to the exact source file and line that is the root cause — bridging the gap between a runtime HTTP observation (e.g. "SQL injection detected at /api/pets/name/<param>") and the vulnerable code that produced it (e.g. raw f-string SQL construction in db.py:32). The correlation report is saved alongside the SARIF as source-correlation.md.
git-commit:
Follow these principles from the security context:
This command uses multiple security context files:
secdevai-review/context/security-review.context - OWASP Top 10 patterns (always loaded)secdevai-review/context/wstg-testing.context - OWASP WSTG v4.2 web app testing patterns (auto-loaded for web code)secdevai-review/context/golang-security.context - Go-specific vulnerabilities and weaknesses (auto-loaded for Go code)Multi-Language Support: While context files contain primarily Python examples, all sub-skills MUST adapt security patterns to the language being reviewed (JavaScript, Java, Go, Ruby, PHP, C#, Rust, etc.). Translate the security principles and provide language-specific remediation with appropriate frameworks and idioms.
This command integrates with:
secdevai-review/context/ directory for security analysis guidelinessecdevai-validate for finding validation, exploitability checks, CVSS scoring, and Red Hat severity calibrationsecdevai-tool for optional tool integration via containerized runnerssecdevai-dast/scripts/rapidast-scan.sh for DAST scanning via RapiDAST (produces SARIF + source-correlation.md)secdevai-export/scripts/results_exporter.py for result export.secdevaiignore for excluding files from scanssecdevai-oci-image-security/references/ for OCI container image security patterns.secdevaiignore file