# Srajangpt1 AI Security Crew AI Security Crew > Perform a pre-coding security review for the following task: - Skill: `tomevault-io/srajangpt1-ai-security-crew-ai-security-crew` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/srajangpt1-ai-security-crew-ai-security-crew` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/srajangpt1-ai-security-crew-ai-security-crew/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/srajangpt1-ai-security-crew-ai-security-crew --- Perform a pre-coding security review for the following task: $ARGUMENTS --- ## What to do Analyze the task description above and produce a structured security assessment. If no task description was provided in the arguments, ask the user to describe what they are building and optionally their tech stack before proceeding. ### Step 1 — Identify Technologies Detect technologies from the description: - Languages: Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, Rust, C# - Frameworks: Django, FastAPI, Flask, Express, Next.js, Spring, Rails, Laravel - Databases: PostgreSQL, MySQL, MongoDB, Redis, SQLite, DynamoDB - Auth: JWT, OAuth2, SAML, session-based, API keys - Infrastructure: AWS, GCP, Azure, Docker, Kubernetes - Other: GraphQL, REST API, gRPC, WebSockets, message queues ### Step 2 — Assess Risk Level **Critical** — payments/financial transactions, healthcare/PHI, authentication system, cryptographic key management, admin functionality, multi-tenant data isolation **High** — PII collection/storage, file uploads, external API integrations, session management, password handling, OAuth flows, database schema changes **Medium** — user-generated content, search functionality, data exports, email/notification systems, third-party SDKs, internal APIs **Low** — static content, read-only public data, internal tooling with no sensitive data ### Step 3 — Identify Security Categories Select all applicable: - `authentication` — login, registration, password reset, MFA - `authorization` — access control, roles, permissions, IDOR - `data_validation` — input validation, sanitization, output encoding - `cryptography` — encryption, hashing, key management, TLS - `api_security` — endpoints, rate limiting, CORS, versioning - `web_security` — XSS, CSRF, clickjacking, CSP - `database` — SQL injection, ORM, connection security - `secrets_management` — credentials, env vars, vaults - `error_handling` — information disclosure, stack traces - `logging` — audit trails, sensitive data in logs - `cloud_security` — IAM, S3 permissions, VPC, security groups - `supply_chain_security` — dependencies, lockfiles ### Step 4 — Apply OWASP Guidelines For each identified category, provide specific, actionable guidance: **Authentication:** Use bcrypt/argon2 for passwords; implement account lockout; secure HttpOnly SameSite cookies; rotate session tokens after login; enforce MFA for high-privilege actions. **Authorization:** Validate permissions server-side on every request; deny-by-default; avoid direct object references; check ownership before granting access. **Data Validation:** Validate and sanitize ALL user input server-side; use allowlists not denylists; encode output based on context (HTML, JS, SQL, URL); validate file uploads by type, size, and content. **Cryptography:** AES-256-GCM or ChaCha20-Poly1305 for encryption; SHA-256+ for hashing (never MD5/SHA1 for security); cryptographically secure random for tokens; never hardcode keys. **API Security:** Authenticate all sensitive endpoints; rate limit per user and per IP; validate Content-Type; return generic error messages (no stack traces in production); HTTPS + HSTS. **Injection Prevention:** Parameterized queries/prepared statements for SQL; avoid eval()/exec() with user input; subprocess with shell=False (Python); sanitize data in OS commands, LDAP, XML, HTML. **Secrets Management:** Never commit secrets to git; use environment variables or secrets manager (Vault, AWS SSM); rotate credentials regularly; scan commits for accidental exposure. ### Step 5 — Output Produce this exact structure: --- ## Pre-Coding Security Review **Task:** [task description] **Risk Level:** [LOW | MEDIUM | HIGH | CRITICAL] **Tech Stack Detected:** [list or "not specified"] **Security Categories:** [comma-separated list] ### Risk Summary [2–3 sentences explaining why this risk level was assigned and what the primary security concerns are for this specific task] ### Security Requirements For each identified category: #### [Category Name] - [Specific requirement 1 — concrete, not generic] - [Specific requirement 2] ### Pre-Coding Checklist - [ ] [Check 1 — most critical for this task] - [ ] [Check 2] - [ ] [Check N — aim for 5–8 checks, task-specific] ### Prompt Injection for AI Code Generation Copy this into your prompt when asking an AI to generate code for this task: ``` SECURITY REQUIREMENTS — apply throughout all generated code: Risk Level: [RISK LEVEL] [Bulleted list of the top 5–7 security requirements written as direct instructions to an AI code generator, specific to this task] ``` --- > Source: [Srajangpt1/ai-security-crew](https://github.com/Srajangpt1/ai-security-crew) — distributed by [TomeVault](https://tomevault.io).