ai-code-audit

Security and quality linter specifically designed for AI-generated code.

The Problem

AI coding assistants can introduce security vulnerabilities and quality issues:

• SQL injection through string concatenation
• Command injection via unsanitized inputs
• Hardcoded secrets and credentials
• Missing error handling
• Unsafe deserialization
• Over-complex "clever" solutions

Traditional linters catch some of these, but AI code has unique patterns that need specific attention.

Installation

npm install -g ai-code-audit

Usage

Audit Files

# Audit a single file
aca src/api.ts

# Audit multiple files
aca src/**/*.ts

# Audit a git diff
git diff HEAD~1 | aca --stdin

# Audit staged changes
git diff --cached | aca --stdin

Options

Options:
  -s, --stdin           Read diff from stdin
  -f, --format <type>   Output format: text, json, sarif (default: text)
  -c, --config <file>   Config file path
  --severity <level>    Minimum severity: info, warning, error (default: warning)
  -q, --quiet           Only output errors
  -h, --help            Show help

Git Hook Integration

Add to .git/hooks/pre-commit:

#!/bin/bash
git diff --cached | aca --stdin --severity error
if [ $? -ne 0 ]; then
  echo "AI code audit found issues. Please review before committing."
  exit 1
fi

CI Integration

# GitHub Actions
- name: AI Code Audit
  run: |
    npm install -g ai-code-audit
    git diff ${{ github.event.before }} ${{ github.sha }} | aca --stdin --format sarif > results.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: results.sarif

Rules

Security Rules

Rule	Severity	Description
sql-injection	error	Detects SQL queries with string interpolation
command-injection	error	Detects shell commands with unsanitized input
hardcoded-secret	error	Detects hardcoded API keys, passwords, tokens
unsafe-eval	error	Detects use of eval() or Function()
unsafe-regex	warning	Detects potentially catastrophic regex
path-traversal	error	Detects unsanitized file path operations
xss-risk	warning	Detects potential XSS in HTML generation

Quality Rules

Rule	Severity	Description
missing-error-handling	warning	Detects async operations without try/catch
empty-catch	warning	Detects empty catch blocks that swallow errors
console-log	info	Detects console.log left in code
todo-fixme	info	Detects TODO/FIXME comments
magic-number	info	Detects unexplained numeric literals
deep-nesting	warning	Detects deeply nested code (>4 levels)

AI-Specific Rules

Rule	Severity	Description
ai-placeholder	error	Detects placeholder text like "// Add implementation"
incomplete-impl	warning	Detects throw new Error('Not implemented')
excessive-comments	info	Detects over-commented obvious code
type-any-abuse	warning	Detects excessive use of any type

Configuration

Create .ai-code-audit.json:

{
  "rules": {
    "sql-injection": "error",
    "console-log": "off",
    "magic-number": "warning"
  },
  "ignore": [
    "**/*.test.ts",
    "**/fixtures/**"
  ],
  "languages": ["typescript", "javascript", "python"]
}

Output Example

src/api/users.ts
  12:5  error    SQL injection risk: query uses string interpolation     sql-injection
  24:3  warning  Missing error handling for async operation              missing-error-handling
  45:1  error    Hardcoded secret detected: API_KEY = "sk-..."           hardcoded-secret

src/utils/shell.ts
  8:12  error    Command injection: exec() with unsanitized input        command-injection

4 problems (3 errors, 1 warning)

License

MIT