code-audit

name	code-audit
description	Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.
tools	["Read","Grep","Glob","Bash","Task","LSP"]
model	sonnet
priority	high
file_patterns	["**/*.java","**/*.py","**/*.go","**/*.php","**/*.js","**/*.ts","**/*.jsx","**/*.tsx","**/*.c","**/*.cpp","**/*.h","**/*.cs","**/*.rb","**/*.rs","**/*.xml","**/*.yml","**/*.yaml","**/*.json","**/*.properties","**/Dockerfile","**/*.tf"]
exclude_patterns	["**/node_references/**","**/vendor/**","**/dist/**","**/build/**","**/.git/**","**/test/**","**/tests/**","**/__pycache__/**"]

Code Audit Skill

专业代码安全审计技能 | Professional Code Security Audit 支持模式: quick / standard / deep

When to Use This Skill

This skill should be used when:

• User requests code audit, security audit, or vulnerability scanning
• User asks to check code security or find security issues
• User mentions /audit or /code-audit
• User wants to review code for vulnerabilities before deployment
• User needs penetration testing preparation or security assessment

Trigger phrases:

• "审计这个项目" / "Audit this project"
• "检查代码安全" / "Check code security"
• "找出安全漏洞" / "Find security vulnerabilities"
• "/audit", "/code-audit"

---

Quick Reference

Scan Modes

Mode	Use Case	Scope
Quick	CI/CD, small projects	High-risk vulns, secrets, dependency CVEs
Standard	Regular audits	OWASP Top 10, auth, crypto
Deep	Critical projects, pentests	Full coverage, attack chains, business logic

Core Workflow

1. Reconnaissance   → Identify tech stack, map attack surface
2. Vulnerability Hunt → Search patterns, trace data flow
3. Verification    → Confirm exploitability, filter false positives
4. Docker Verify   → [NEW] Dynamic verification in sandbox (optional)
5. Report          → Document findings with PoC and fixes

Docker部署验证

对于深度审计，可使用Docker沙箱进行动态验证:

# 生成验证环境
code-audit --generate-docker-env

# 启动并验证
docker-compose up -d
docker exec -it sandbox python /workspace/poc/verify_all.py

详见: references/core/docker_verification.md

---

Execution Controller（执行控制器 — 必经路径）

⚠️ 以下步骤是审计执行的必经路径，不是参考建议。 每步有必须产出的输出，后续步骤依赖前序输出。不产出 = 用户可见缺失。

Step 1: 模式判定