Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Adversarial Code Reviewer

    1

    An evidence-based reviewer that finds exploitable bugs and security flaws using adversarial threat modeling.

    $22

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Adversarial Code Reviewer

    Adversarial Code Reviewer

    Example session with this skill installed

    Perform an adversarial review of the authentication logic in src/auth/session.ts. Focus on session hijacking risks and token validation. Use the provided diff from PR #42.

    • Read your context and instructions
    • Compiled the adversarial code reviewer

    I have completed an adversarial review of the session management logic in src/auth/session.ts. The review focused on identifying exploitable flaws in token validation and storage.

    Adversarial Review Report: PR #42

    FindingFile:LineSeverityConfidenceImpact
    Weak Token Generationsrc/auth/session.ts:14CriticalHighPredictable session IDs allow for account hijacking via brute force.
    Missing Expiry Checksrc/auth/session.ts:42HighHighTokens remain valid indefinitely after logout, increasing the attack surface.
    Insecure Cookie Flagssrc/auth/session.ts:58MediumMediumHttpOnly and Secure flags are missing, exposing tokens to XSS scripts.
    Redundant Type Checksrc/auth/session.ts:89LowHighMinor maintainability issue; duplicate validation of the userId string.

    Technical Analysis

    The implementation uses Math.random() for session secret generation at line 14. This is cryptographically insecure. Furthermore, the validateSession function lacks a timestamp comparison against the expires_at column in the database, meaning revoked sessions may still grant access if the token is known.

    Verification Plan

    • Test Command: npm run test:security -- src/auth/session.test.ts
    • Expected Result: Should fail on session reuse after logout() call.
    • Execution Status: NOT RUN (Environment requires process.env.DB_URL)

    Verdict

    CHANGES REQUESTED
    The predictable token generation is a blocker. The session validation logic must be updated to check expiration timestamps before authorizing requests.

    Next steps

    1. Replace Math.random() with crypto.randomBytes() for all secret generation.
    2. Add a Date.now() > session.expiresAt check in the validateSession middleware.
    3. Configure the session cookie with httpOnly: true and secure: true in the production config.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Code reviews often suffer from "LGTM" culture or subjective nitpicking that misses critical logic flaws. This skill implements an adversarial review workflow designed to find exploitable bugs, security vulnerabilities, and functional regressions before they hit production. It prioritizes evidence over opinion by requiring specific file paths, line ranges, and reproduction steps for every finding.

    What it does

    • Adversarial threat modeling proactively identifies risks in authentication, authorization, and data handling.
    • Evidence-based reporting requires exact file/line references and impact analysis for every identified issue.
    • Confidence scoring distinguishes between confirmed exploits and unverified hypotheses to prevent false alarms.
    • Prioritized severity ranking ensures critical security and correctness blockers are addressed before maintainability nits.
    • Verification checklists provide concrete commands and criteria to validate that fixes actually work.

    How it works

    1. Scope definition establishes the baseline by reading diffs, callers, and requirement docs.
    2. Assumption falsification attempts to break the logic using static checks or focused tests.
    3. Structured reporting generates a review ordered by impact with minimal recommended fixes.
    4. Final verdict issues a block, changes requested, or approve status with a verification plan.

    Frameworks & tools

    This skill is language-agnostic and works with any version control system. It utilizes standard CLI tools for static analysis and testing when available in the environment.

    Why this beats prompting it yourself

    Generic prompts often return vague advice like "add more comments" or "refactor this function." This skill enforces a strict evidence-driven contract that prevents the agent from praising code it hasn't thoroughly stress-tested against boundary conditions.

    Use cases

    • Reviewing security-sensitive patches before merging into main branches.
    • Auditing code written by other AI agents to catch "hallucinated" logic.
    • Identifying data races and persistence failures in backend microservices.
    • Performing pre-release regression checks on complex PRs.

    Known limitations

    Requires access to surrounding context beyond just the diff for high-confidence reviews. It cannot execute destructive operations or external service requests without explicit user authorization.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 2 days ago

    • Passed all security checks, Safe to install

    Listed2 days ago

    What's inside

    Frequently Asked Questions