Code Audit Skill for Claude Code

> Professional white-box code security audit skill with 55+ vulnerability types, dual-track audit model, and multi-agent deep analysis. 中文文档

Overview

Code Audit is a professional security audit skill for Claude Code. It performs static white-box analysis to systematically discover and verify security vulnerabilities in source code.

Key Features

• 9 Languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust
• 14 Frameworks: Spring Boot, Django, Flask, FastAPI, Express, Koa, Gin, Laravel, Rails, ASP.NET Core, Rust Web, NestJS/Fastify, MyBatis
• 55+ Vulnerability Types: SQL injection, RCE, deserialization, SSRF, SSTI, XXE, IDOR, race conditions, business logic flaws, and more
• 143 Mandatory Detection Items: Language-specific checklists across 10 security dimensions (D1-D10)
• Dual-Track Audit Model: Sink-driven for injection/RCE + Control-driven for authorization/business logic
• Multi-Agent Deep Analysis: Parallel agent execution for large codebases (874+ Java files in ~15 min)
• WooYun Case Library: 88,636 real-world vulnerability cases (2010-2016) for pattern reference
• Attack Chain Construction: Automatic chaining of findings into exploitable attack paths

Installation

bash
Clone to Claude Code skills directory

cp -r code-audit ~/.claude/skills/

Or clone from repository

cd ~/.claude/skills
git clone <repository-url> code-audit

The skill activates automatically when you request security audits in Claude Code.

Usage

Trigger Phrases

"Audit this project"
"Check code security"
"Find security vulnerabilities"
"/audit" or "/code-audit"

Scan Modes

| Mode | Use Case | Scope | |------|----------|-------| | Quick | CI/CD, small projects | High-risk vulns, secrets, dependency CVEs | | Standard | Regular audits | OWASP Top 10, auth, crypto, 1-2 rounds | | Deep | Critical projects, pentests | Full coverage, attack chains, business logic, 2-3 rounds |

Example

User: /code-audit deep /path/to/project

Claude: [MODE] deep
        [RECON] 874 files, Spring Boot 1.5 + Shiro 1.6 + JPA + Freemarker
        [PLAN] 5 Agents, D1-D10 coverage, estimated 125 turns
        ... (user confirms) ...
        [REPORT] 10 Critical, 14 High, 12 Medium, 4 Low

Architecture

Dual-Track Audit Model

Different vulnerability types require fundamentally different detection strategies: | Track | Dimensions | Method | What It Finds | |-------|-----------|--------|---------------| | Sink-driven | D1 (Injection), D4 (Deserialization), D5 (File Ops), D6 (SSRF) | Grep dangerous patterns -> trace data flow -> verify no defense | Dangerous code that exists | | Control-driven | D3 (Authorization), D9 (Business Logic) | Enumerate endpoints -> verify security controls exist -> missing = vuln | Security controls that are absent | | Config-driven | D2 (Auth), D7 (Crypto), D8 (Config), D10 (Supply Chain) | Search configs -> compare against baseline | Misconfigurations |

10 Security Dimensions

| # | Dimension | Coverage | |---|-----------|----------| | D1 | Injection | SQL/Cmd/LDAP/SSTI/SpEL/JNDI | | D2 | Authentication | Token/Session/JWT/Filter chain | | D3 | Authorization | CRUD permission consistency, IDOR | | D4 | Deserialization | Java/Python/PHP gadget chains | | D5 | File Operations | Upload/download/path traversal | | D6 | SSRF | URL injection, protocol restriction | | D7 | Cryptography | Key management, cipher modes, KDF | | D8 | Configuration | Actuator, CORS, error exposure | | D9 | Business Logic | Race conditions, mass assignment, state machine, multi-tenant | | D10 | Supply Chain | Dependency CVEs, version checks |

Multi-Agent Workflow

``` Phase 1: Reconnaissance -> Tech stack identification -> Attack surface mapping (5-layer deduction) -> Endpoint-Permission Matrix generation -> Agent allocation ...