Skip to content
Skillpedia
PT
Security42k · #4756

code-audit

Lets your agent analyze program source code for security flaws. Useful for finding common errors and verifying if fixes were applied correctly.

What it does

This tool helps find security flaws in a program's code. It checks for common mistakes that hackers could exploit, like code injections or exposed passwords.

When to use it

  • ✓When reviewing code before it goes live.
  • ✓When you suspect a piece of code might have a vulnerability.
  • ✓After making code changes to ensure no new flaws were introduced.

Example of what to ask your AI

“Analyze this Python code for common security vulnerabilities.”

Want more? Open the sections below.

How to use

The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.

Skill link

https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/code-audit/SKILL.md

Ready-to-paste message

Use this skill to help me: https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/code-audit/SKILL.md Read the SKILL.md file at that link and follow its instructions for my task.
View on GitHub ↗Raw file
How it works

The tool uses specific programs (like Semgrep and CodeQL) to scan the code for known security flaw patterns. It also checks for dangerous function usage and verifies if fixes have been correctly applied.

Installation

Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.

In the terminal (Claude Code, Codex, Cursor), in your project folder:

npx skills add zhaoxuya520/reverse-skill --skill code-audit

Or download just the file:

curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/code-audit/SKILL.md -o SKILL.md
Technical content (original SKILL.md)

Original text by the author, straight from GitHub.

Source Code Security Audit

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权
  2. NOW: 确认有源码/仓库访问（无源码二进制 → 转 RE skill）
  3. NOW: 明确语言栈与范围（目录/服务/PR diff）
  4. NEXT: tool-index；semgrep 等
  5. ACT: 威胁建模草图 → 自动扫描 → 人工验证

适用场景

  • 白盒审计、PR/差分安全审查
  • Semgrep / CodeQL / Bandit / gosec 等 SAST
  • 危险 API、注入点、鉴权缺失、加密误用
  • 与 supply-chain-security/ 分工：本 skill 偏自有代码逻辑，供应链偏依赖与管道

工作流

1. 范围与威胁模型

□ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产：鉴权、支付、管理端、密钥处理

2. 自动扫描

semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .

3. 人工验证（MUST）

□ 每个 SAST 命中：可达性？可利用性？误报？
□ 鉴权：IDOR/越权、缺校验、错误的多租户隔离
□ 注入：SQL/命令/模板/LDAP
□ 加密：硬编码密钥、ECB、自定义 crypto

4. 产出

Finding：位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号

工具链

工具 语言/场景
Semgrep 多语言快速规则
CodeQL 深数据流（GitHub）
Bandit Python
gosec / staticcheck Go
SpotBugs / FindSecBugs Java

参考

  • references/sast-review-checklist.md
  • ../supply-chain-security/ ../api-security/ ../llm-security/（Agent 代码）

路由上下文

上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain；运行时验证 → pentest-tools

任务完成自检

  • 是否人工验证而非只贴扫描器输出？
  • 是否含修复建议？
  • 是否限定在授权仓库范围？
  • Checklist？
FAQ

What is SAST?

SAST stands for 'Static Application Security Testing,' which is a way to test code security without running it, looking for flaw patterns.

What are 'injection points'?

These are places in the code where an attacker might insert malicious commands to trick the program and steal information or gain control.

What is 'fix verification'?

This means checking if a previously identified security flaw has actually been fixed and can no longer be exploited.

Details

Original description by the author

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

repo: zhaoxuya520/reverse-skill

Popularity

GitHub stars
42k
Ranking position
#4756
License
MIT
Updated
9/22/2026

Is this skill useful?

0

Sign in to vote.

Comments

  • …

More skills from this repository

Agents42k

competition-ad-certificate-abuse

Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.

zhaoxuya520/reverse-skill

Agents42k

competition-agent-cloud

Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.

zhaoxuya520/reverse-skill

Mobile apps42k

competition-android-hooking

Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.

zhaoxuya520/reverse-skill

Websites & UI (frontend)42k

competition-browser-persistence

Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.

zhaoxuya520/reverse-skill

Similar skills

Security280k

django-security

Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.

affaan-m/ECC

Security280k

laravel-security

Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.

affaan-m/ECC

Security280k

module-regression

Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.

affaan-m/ECC