code-audit
starsforks
How to install code-audit?
zhaoxuya520/reverse-skill/code-audit
$npx -y skills add zhaoxuya520/reverse-skill --skill code-auditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
SKILL.md
| 1 | # Source Code Security Audit |
| 2 | |
| 3 | ## ACTION REQUIRED（读完后立刻执行） |
| 4 | |
| 5 | 1. `NOW`: 读取 `../field-journal/precedent-pentest.md` 或代码审计授权 |
| 6 | 2. `NOW`: 确认有**源码/仓库访问**（无源码二进制 → 转 RE skill） |
| 7 | 3. `NOW`: 明确语言栈与范围（目录/服务/PR diff） |
| 8 | 4. `NEXT`: tool-index；semgrep 等 |
| 9 | 5. `ACT`: 威胁建模草图 → 自动扫描 → 人工验证 |
| 10 | |
| 11 | ## 适用场景 |
| 12 | |
| 13 | - 白盒审计、PR/差分安全审查 |
| 14 | - Semgrep / CodeQL / Bandit / gosec 等 SAST |
| 15 | - 危险 API、注入点、鉴权缺失、加密误用 |
| 16 | - 与 `supply-chain-security/` 分工：本 skill 偏**自有代码逻辑**，供应链偏依赖与管道 |
| 17 | |
| 18 | ## 工作流 |
| 19 | |
| 20 | ### 1. 范围与威胁模型 |
| 21 | |
| 22 | ```text |
| 23 | □ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件 |
| 24 | □ 高价值资产：鉴权、支付、管理端、密钥处理 |
| 25 | ``` |
| 26 | |
| 27 | ### 2. 自动扫描 |
| 28 | |
| 29 | ```bash |
| 30 | semgrep --config auto . |
| 31 | # 或项目规则包 |
| 32 | semgrep --config p/owasp-top-ten . |
| 33 | ``` |
| 34 | |
| 35 | ### 3. 人工验证（MUST） |
| 36 | |
| 37 | ```text |
| 38 | □ 每个 SAST 命中：可达性？可利用性？误报？ |
| 39 | □ 鉴权：IDOR/越权、缺校验、错误的多租户隔离 |
| 40 | □ 注入：SQL/命令/模板/LDAP |
| 41 | □ 加密：硬编码密钥、ECB、自定义 crypto |
| 42 | ``` |
| 43 | |
| 44 | ### 4. 产出 |
| 45 | |
| 46 | ```text |
| 47 | Finding：位置 + 数据流 + PoC + 修复建议 |
| 48 | 可选 ATT&CK / CWE 编号 |
| 49 | ``` |
| 50 | |
| 51 | ## 工具链 |
| 52 | |
| 53 | | 工具 | 语言/场景 | |
| 54 | |------|-----------| |
| 55 | | Semgrep | 多语言快速规则 | |
| 56 | | CodeQL | 深数据流（GitHub） | |
| 57 | | Bandit | Python | |
| 58 | | gosec / staticcheck | Go | |
| 59 | | SpotBugs / FindSecBugs | Java | |
| 60 | |
| 61 | ## 参考 |
| 62 | |
| 63 | - `references/sast-review-checklist.md` |
| 64 | - `../supply-chain-security/` `../api-security/` `../llm-security/`（Agent 代码） |
| 65 | |
| 66 | ## 路由上下文 |
| 67 | |
| 68 | **上游**: MASTER R26 |
| 69 | **角色**: `ops/role-map.md` cae |
| 70 | **下游**: 依赖漏洞 → supply-chain；运行时验证 → pentest-tools |
| 71 | |
| 72 | ## 任务完成自检 |
| 73 | |
| 74 | - [ ] 是否人工验证而非只贴扫描器输出？ |
| 75 | - [ ] 是否含修复建议？ |
| 76 | - [ ] 是否限定在授权仓库范围？ |
| 77 | - [ ] Checklist？ |
People who liked this also viewed
6 picksType
- requesting-code-reviewUse when completing tasks, implementing major features, or before merging to verify work meets requirementsSkillsJul 2026
- code-reviewSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- receiving-code-reviewUse when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performativeSkillsJul 2026
- baoyu-format-markdownFormats plain text or markdown files with frontmatter, titles, summaries, headings, bold, lists, and code blocks. Use when user asks to "format markdown", "beautify article", "add formatting", or imprSkillsJul 2026
- code-review-excellenceMaster effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing reSkillsJul 2026
- code-review-and-qualityConducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensiSkillsJul 2026
