Hire an AI API security repair reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A ranked list of sign-in, access and input gaps, with a fix written for each
• A list of the new behaviours no test covers, with test cases to add
• A review of the finished change, ranked by how serious each issue is
• A pull request description with before and after proof and a note on what else could break

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: A scan or audit found gaps in your API and you need to merge fixes this week.

• Step 1: API security gaps. Each route and who may call it, the gaps ranked by how serious they are, and a fix for each.
• Step 2: Test gaps. Which new behaviours your tests cover, miss or leave unknown, with test cases to add for the gaps.
• Step 3: Change review. Issues in the fixes and new tests together, ranked by severity, with review comments.
• Step 4: Pull request. A summary, before and after evidence, whether the merge can be undone and what else it could touch.
• Hand-back summary. Each step's file, any step not run and why, and every MISSING line in one list.

How the work is checked

• Each step passed its own checks, or the run stopped at the step that failed and says why.
• The steps ran in order, and each one used the result of the one before.
• Nothing was invented to fill a gap. Every gap is a MISSING: line.
• Nothing was sent, published or paid for without a clear yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Check the routes and write the fixes. Lists each route and who may call it, checks sign-in, access rules and input handling, ranks the gaps and writes a fix for each.
• Find the fixes no test would catch. Reads the fixes from step 1, searches your tests for one that would fail if each fix broke, and writes a test case for every gap.
• Add the tests and run them. This one is yours. Add the proposed tests, run the whole suite and fix any failure before the review.
• Review the whole change. Reads the fixes and the new tests together for breaking changes, wider impact and new security slips, and ranks the findings.
• Write the pull request. Sums up the change, shows before and after evidence, says whether the merge can be undone and what else it could touch.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id fix-api-security-gaps-with-tests-and-a-clear-pull-request only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/fix-api-security-gaps-with-tests-and-a-clear-pull-request/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your API code (a folder or repo the AI can open)
• Your test folder, so it can see what is already covered
• Who your callers are and how they sign in (optional)

Functions and deliverables

• API security repair reviewer: Review API sign-in, access and input checks, make fixes and review the tests and change risk before writing the pull request.
  • A ranked list of sign-in, access and input gaps, with a fix written for each
  • A list of the new behaviours no test covers, with test cases to add
  • A review of the finished change, ranked by how serious each issue is
  • A pull request description with before and after proof and a note on what else could break
• API security checker: Share your API routes. Get a check of sign-in, access rules and input, with fixes for each gap.
  • A findings list for each route, with a severity for each gap
  • A fix for each gap
  • Notes on rate limits, error leaks and logs
  • The test that proves each fix works
  • A list of routes and paths it could not check
  Source: sickn33.
• Code change test coverage reviewer: Find what a code change does that no test checks. Give it your diff and tests. Get each behaviour marked covered or not, plus test cases for gaps.
  • A list of new behaviours
  • A covered, not covered or unknown label for each
  • Evidence for each label
  • Proposed test cases for the gaps
  Source: Pro Skill Packs.
• Pull request risk reviewer: Review a pull request for risk. Get issues ranked by severity, security findings and review comments you can post before you merge.
  • Findings ranked by severity
  • Security notes
  • Breaking change warnings
  • Test coverage gap
  • Ready-to-post review comments
  Source: Alireza Rezvani.
• Pull request writer: Turn your code changes into a pull request description with a picture, proof it works, and a merge risk note that reviewers can scan fast.
  • Pull request body in a set template
  • A diagram, tree or code sketch of the change
  • Before and after evidence section
  • Merge risk rating
  Source: Matt Pocock.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• A scan or audit found gaps in your API and you need to merge fixes this week.
• You added routes fast and never checked who may call them.
• You want the fixes to stay fixed, with tests that fail if someone removes them.

Limits to check before starting

• You only want to review one file or a codebase that is not an API: use the API security checker on its own.
• You want a security scan with no code changes: use the API security checker and stop after step 1.
• You need to review a pull request someone else wrote: use the Pull request risk reviewer on its own.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the handoff pack. It's a zip with HANDOFF.md and every skill file this workflow uses.
• Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say "Follow HANDOFF.md".
• Point it at the API folder and the tests. Use a test copy, not production data.
• After step 2, add the tests and run your suite before you continue.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/fix-api-security-gaps-with-tests-and-a-clear-pull-request for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.