Expert-level code security audit skill using deep data flow analysis and business logic understanding for white-box static analysis across 9 languages
triggers
["audit this codebase for security vulnerabilities","perform a security code review","find security issues in this project","analyze code for OWASP vulnerabilities","check for injection flaws and authentication issues","run a deep security audit","scan for SQL injection and RCE vulnerabilities","review code security following OWASP Top 10"]
A professional code security audit skill designed for AI coding agents, implementing a five-phase standardized audit protocol with dual-track analysis (Sink-driven, Control-driven, Config-driven) to systematically discover and validate security vulnerabilities in source code.
Race conditions, mass assignment, state machine flaws
D10
Supply Chain
Dependency CVEs, outdated packages
Scan Modes
Mode
Use Case
Scope
Time
Quick
CI/CD, small projects
Critical vulns, secrets, dependency CVEs
5-10 min
Standard
Regular audits
OWASP Top 10, auth/authz, crypto
30-60 min
Deep
Critical projects, pentest prep
Full coverage, attack chains, business logic
1-3 hours
Usage Patterns
Basic Audit Request
Trigger an audit using natural language:
"Audit this codebase for security vulnerabilities"
"Perform a deep security review of this Spring Boot project"
"Find SQL injection and authentication issues"
1. [CONTROL] Enumerated admin endpoints: /admin/users, /admin/user/:id
2. [CHECK] Searched for middleware: auth.isAdmin, requireAdmin
3. [MISSING] No authorization middleware found
4. [VALIDATION] Direct access possible without admin role
5. [VULNERABILITY] Missing Authorization (High)
# Django vulnerable patterndefsearch_users(request):
query = request.GET.get('q')
# Raw SQL with format string - VULNERABLE
users = User.objects.raw(
f"SELECT * FROM users WHERE name LIKE '%{query}%'"
)
return render(request, 'users.html', {'users': users})
# Fixed versiondefsearch_users(request):
query = request.GET.get('q')
# Use parameterized query
users = User.objects.raw(
"SELECT * FROM users WHERE name LIKE %s",
[f'%{query}%']
)
return render(request, 'users.html', {'users': users})
// Vulnerable controller@GetMapping("/api/orders/{orderId}")public Order getOrder(@PathVariable Long orderId) {
// Missing authorization check - any user can access any orderreturn orderService.findById(orderId);
}
// Fixed version@GetMapping("/api/orders/{orderId}")public Order getOrder(@PathVariable Long orderId,
@AuthenticationPrincipal User currentUser) {
Orderorder= orderService.findById(orderId);
// Verify order belongs to current userif (!order.getUserId().equals(currentUser.getId()) &&
!currentUser.isAdmin()) {
thrownewAccessDeniedException("Cannot access this order");
}
return order;
}
# Vulnerable transfer functiondeftransfer_money(from_account, to_account, amount):
# Race condition: multiple concurrent transfers can overdraw
balance = get_balance(from_account)
if balance >= amount:
time.sleep(0.1) # Simulate processing delay
decrease_balance(from_account, amount)
increase_balance(to_account, amount)
returnTruereturnFalse# Fixed version with transaction lockfrom django.db import transaction
@transaction.atomicdeftransfer_money(from_account, to_account, amount):
# Use select_for_update to lock row
account = Account.objects.select_for_update().get(id=from_account)
if account.balance >= amount:
account.balance -= amount
account.save()
recipient = Account.objects.select_for_update().get(id=to_account)
recipient.balance += amount
recipient.save()
returnTruereturnFalse
Troubleshooting
Issue: High False Positive Rate
Solution:
# Enable stricter validationexport DFYX_VALIDATION_MODE=strict
# Require POC generation for all findingsexport DFYX_REQUIRE_POC=true# Run with actual testing verification
python scripts/code_scan.py /path/to/project --verify-with-tests
The skill automatically identifies vulnerability combinations:
Attack Chain #1: Admin Account Takeover
├─ [Step 1] IDOR in /api/user/{id} (No authorization check)
├─ [Step 2] User enumeration via timing attack
├─ [Step 3] Password reset token prediction (weak randomness)
└─ [Impact] Full admin account compromise
POC:
1. Enumerate admin user ID: GET /api/user/1 (returns admin profile)
2. Trigger password reset: POST /api/reset-password {userId: 1}
3. Predict token using timestamp + user ID
4. Reset admin password: POST /api/confirm-reset {token: predicted}
Business Logic Vulnerability Detection
# Example: Discount code reuse vulnerability@app.route('/apply-discount', methods=['POST'])defapply_discount():
code = request.json['code']
# Missing: check if code already used by this user
discount = DiscountCode.query.filter_by(code=code).first()
if discount:
session['discount'] = discount.percentage
return {'success': True}
Detection:
[BUSINESS_LOGIC] Missing state validation
├─ Endpoint: /apply-discount
├─ Issue: No check for duplicate discount code usage
├─ Impact: User can apply same discount code multiple times
└─ Fix: Add user-code usage tracking table
WooYun Case Database
The skill includes 1000+ real-world vulnerability cases from WooYun (2010-2016):
# Search WooYun cases for similar vulnerabilities
python scripts/code_scan.py /path/to/project --with-wooyun-cases
# Output will reference similar cases# "Similar to WooYun-2016-12345: Dedecms SQL Injection in article.php"
Best Practices
Pre-Audit Checklist
Ensure complete source code access
Identify all entry points (APIs, forms, file uploads)
Document authentication mechanisms
List third-party dependencies
During Audit
Confirm each finding with POC
Test in isolated environment
Document data flow with diagrams
Prioritize by exploitability + impact
Post-Audit
Validate all remediation code
Re-scan after fixes
Add to regression test suite
Update threat model
License
MIT License - Free for security research and educational purposes only.
Resources
Documentation: resources/knowledge/ (13 knowledge base documents)
