DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to audit local code changes for security problems with Code AF

Run the sec specialist on changes since main and get findings with evidence and fixes.

Remote script. The install step pipes a remote script from agentfield.ai into bash, so review it or pin a version from the releases page first.

Who it is forA developer or security-minded engineer about to merge a branch who wants a second look at the security impact of the changes.

The problemChanges pile up between merges and a manual security read of every diff is slow and easy to skip.

The outcomeA Markdown, JSON or SARIF report of security findings with evidence and suggested fixes, plus the coverage notes that show what was analyzed.

What you need first

  • macOS or Linux machine with a terminal
  • A provider key (OpenRouter, DeepSeek, GLM, Kimi, MiniMax, Qwen), a ChatGPT plan through Codex, or a running Ollama install
  • A git repository for the project you want to work on
  • Install CodeAF with the curl script, or build it from source with make build

Steps

  1. Run curl -fsSL https://agentfield.ai/get/codeaf | bash and then codeaf.
  2. Connect a provider on first start, in the browser through OpenRouter or with a key.
  3. Open the project's folder in Code AF and type /sec changes since main.
  4. Open the sec task to follow the work, then read the findings and the coverage notes in the report.
  5. Treat the result as a review aid: a missing finding does not prove the code is free of security problems.

Prompt for your agent

Use the CodeAF repo at Agent-Field/CodeAF. Install it with its curl script, open the git repository at <project-path>, and run `/sec changes since main` in the chat. Expected output: a security report with findings, evidence and suggested fixes, in Markdown, JSON or SARIF. Verify that the report lists its coverage and any incomplete analysis, and that your source files were not modified.

Caveat. The README says the sec audit reads source code without running your tests, build, app or exploits, so its results are static analysis only.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page