{ "schema": "aiblocks-page/1", "id": "agency-security-appsec-engineer", "type": "agent", "name": "Application security reviewer", "summary": "Get a threat model and secure code review for your feature, with bugs to fix before merge, hardening tips and security requirements you can test.", "headline": "Application security reviewer", "subhead": "Describe a feature or paste the code that handles sign-in, user input or data. It maps what could be attacked, reviews the code for common flaws, and turns each risk into a fix and a test. You get findings ranked by what to fix before you ship.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "codebase", "required": false, "label": "Codebase", "what": "a project's code, in a folder or repo the AI can open" } ], "outputs": [ { "type": "security_report", "required": true, "label": "Security report", "what": "the risks found in the code, ranked, each with a fix" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "A short description of the feature or system, what it does and what data it handles.", "The code to review, pasted or uploaded, such as sign-in code, API routes or file upload handling (optional)", "Your language, framework and where it runs, such as Python with Django on AWS.", "How sensitive the data is, and any rules you follow, such as PCI-DSS, HIPAA or SOC 2 (optional)", "Your scanner results or past findings (optional)" ], "you_get": [ "A threat model with assets, trust boundaries and a table of threats by STRIDE", "Code findings split into fix before merge and improve when you can, each with evidence and a fix", "A numbered list of security requirements you can test", "Tests to add so each fixed bug stays fixed", "Advice on scanning tools and a list of what was not checked" ], "use_when": [ "You are about to build a feature that handles sign-in, payments, uploads or personal data and want the risks listed first.", "A teammate opened a pull request touching access checks or user input and you want a security review of it.", "A customer sent a security questionnaire and you need a threat model and a list of security requirements.", "Your scanner reports many issues and you want to know which ones matter and what to fix first." ], "skip_when": [ "Your code was mostly written by an AI tool and you worry about leaked keys or open database rules. Use the AI-written code security reviewer.", "You want only a threat model with no code review. Use the Threat modeler.", "You want someone to attack your running app. Use the Penetration test planner, and only on systems you own.", "You want a security design for a whole company or cloud setup. Use the Security Architect agent." ], "output_sample": { "input": [ "A short description of the feature and the data it handles", "The code to review (optional)", "Your language, framework and where it runs", "Data sensitivity and rules you follow (optional)" ], "prerequisites": [ "Real keys and personal data removed from anything you paste", "An AI tool that can open your project folder, if you want a whole project reviewed" ], "output": [ { "name": "Scope", "contains": "The feature, data, stack and rules the review was built on." }, { "name": "Assets and trust boundaries", "contains": "What is worth protecting, where it lives and where trust changes." }, { "name": "Threat table", "contains": "Threats grouped by the six STRIDE questions, each with where, risk and fix." }, { "name": "Code findings", "contains": "Each flaw marked fix before merge or improve later, with evidence and a fix in your framework." }, { "name": "Security requirements", "contains": "Numbered requirements that can be tested in review or in automated tests." }, { "name": "Tests to add", "contains": "Regression tests that stop each fixed bug from coming back." }, { "name": "Scanning and tracking advice", "contains": "Where scanners fit, what they will miss and how to track fixes to closure." }, { "name": "Gaps and checks", "contains": "What the review could not check and how you can check it." } ] }, "output_shape": "SCOPE\n Feature | Data | Stack | Rules \n\nASSETS AND TRUST BOUNDARIES\n | | \n | \n\nTHREAT TABLE (STRIDE)\n | | | | \n\nCODE FINDINGS\n [] | | \n Evidence: \n Fix: \n\nSECURITY REQUIREMENTS\n \n\nTESTS TO ADD\n | \n\nSCANNING AND TRACKING ADVICE\n | | \n\nGAPS AND CHECKS\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.", "Describe the feature and your stack. Paste the code that handles sign-in, access checks, user input or data. Remove real keys and personal data first. For a whole project, use an AI tool that can open your project folder.", "Type \"Threat model this first, then review the code. Mark each finding fix before merge or improve later. Show the evidence and the fix. Tell me what you could not check.\"", "Read the fix-before-merge findings first. Ask it to explain any you do not follow, and to show the fix in your framework.", "Turn the requirements into tickets and the tests into real tests. The AI does not run any code.", "After you fix, paste the changed code back and ask it to confirm each fix really closes the bug." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "AI agent attack tester", "url": "https://useaiblocks.com/skills/ai-agent-attack-tester", "why": "AI agent attack tester" }, { "name": "Prompt injection defender", "url": "https://useaiblocks.com/skills/prompt-injection-defender", "why": "Prompt injection defender" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-appsec-engineer.md", "licence": "MIT", "original_name": "Application Security Engineer", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Application Security Engineer", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-appsec-engineer.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-appsec-engineer", "markdown": "https://useaiblocks.com/agents/agency-security-appsec-engineer.md", "json": "https://useaiblocks.com/agents/agency-security-appsec-engineer.json", "instructions": "https://useaiblocks.com/skills/agency-security-appsec-engineer/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-appsec-engineer.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-appsec-engineer", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-appsec-engineer", "mcp": "https://useaiblocks.com/mcp" } }