dfyx-code-security-auditor

# dfyx-code-security-auditor > Skill by [ara.so](https://ara.so) — Security Skills collection. Expert-level code security auditing based on deep data flow analysis and business logic understanding. Implements a standardized 5-phase white-box static analysis methodology to systematically discover and validate security vulnerabilities in source code. ## What This Skill Does **dfyx_code_security_review** provides systematic code security auditing through: - **Multi-language support**: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust - **10 security dimensions**: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain - **3-track audit model**: Sink-driven (injections), Control-driven (authorization/logic), Config-driven (configurations) - **5-phase protocol**: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting - **Real-world case library**: Based on WooYun vulnerability cases (2010-2016) ## Installation This skill is designed to be used within AI coding agents that support custom skills. **For Claude Code:** ```bash cd ~/.claude/skills/ git clone https://github.com/EastSword/skill-dfyx_code_security_review.git dfyx-code-security-auditor ``` **For Cursor/Windsurf:** ```bash # Add to your .cursorrules or workspace configuration # Copy the skill directory to your project's .ai/ folder mkdir -p .ai/skills git clone https://github.com/EastSword/skill-dfyx_code_security_review.git .ai/skills/dfyx-code-security-auditor ``` **Python Dependencies (for helper scripts):** ```bash pip install -r requirements.txt ``` ## Core Methodology ### 5-Phase Audit Protocol ``` Phase 1: Reconnaissance & Mapping (10%) ├─ Identify tech stack, frameworks, dependencies ├─ Map attack surface, entry points, data flows └─ Output: Architecture diagram, attack surface inventory Phase 2: Pattern Matching (30%) ├─ Parallel scanning across 10 dimensions ├─ Grep dangerous functions, missing controls └─ Output: High-risk areas, candidate vulnerabilities Phase 3: Deep Taint Tracking (40%) ├─ Trace data flows from sources to sinks ├─ Validate sanitization and security controls └─ Output: Confirmed vulnerabilities with proof Phase 4: Validation & Attack Chain (15%) ├─ Build exploit chains, test PoCs ├─ Cross-validate with multiple agents └─ Output: Validated vulnerabilities with PoC Phase 5: Structured Reporting (5%) ├─ Generate detailed reports ├─ Provide fix recommendations └─ Output: Complete audit report ``` ### 10 Security Dimensions | Dimension | Coverage | Method | |-----------|----------|--------| | **D1: Injection** | SQL, Command, LDAP, SSTI, SpEL, JNDI | Sink-driven: Find dangerous functions → trace input | | **D2: Authentication** | Token, Session, JWT, Filter chains | Config-driven: Check implementation completeness | | **D3: Authorization** | CRUD permissions, IDOR, horizontal privilege escalation | Control-driven: Verify controls exist | | **D4: Deserialization** | Java/Python/PHP gadget chains | Sink-driven: Find unserialize() → trace input | | **D5: File Operations** | Upload, download, path traversal | Sink-driven: Find file ops → validate sanitization | | **D6: SSRF** | URL injection, protocol restrictions | Sink-driven: Find HTTP clients → trace URLs | | **D7: Cryptography** | Key management, cipher modes, KDF | Config-driven: Check crypto implementations | | **D8: Configuration** | Debug endpoints, CORS, info disclosure | Config-driven: Scan config files | | **D9: Business Logic** | Race conditions, mass assignment, state machines | Control-driven: Model workflows → find gaps | | **D10: Supply Chain** | Dependency CVEs, version checks | Config-driven: Scan dependencies | ## Audit Modes ### Quick Mode (5-10 minutes) ``` Scope: Critical vulnerabilities, secrets, dependency CVEs Use: CI/CD pipelines, small projects Coverage: D1 (Injection), D10 (Supply Chain), Secret detection ``` ### Standard Mode (30-60 minutes) ``` Scope: OWASP Top 10, auth/authz, crypto Use: Regular audits, pre-deployment checks Coverage: D1-D8 ``` ### Deep Mode (1-3 hours) ``` Scope: Full coverage, attack chains, business logic Use: Major releases, penetration test prep Coverage: D1-D10 + attack chain analysis ``` ## Usage Patterns ### Basic Security Audit **Trigger the audit:** ``` Audit this project for security vulnerabilities using deep mode ``` **Expected workflow:** ``` [MODE] deep [RECON] Analyzing 874 files... Tech Stack: Spring Boot 1.5 + Apache Shiro 1.6 + JPA + Freemarker Entry Points: 43 REST endpoints, 12 template views Attack Surface: User input in 28 endpoints, file upload in 3 [PLAN] Deploying 5 parallel agents: Agent-D1: Injection vulnerabilities Agent-D234: Auth + Authz + Deserialization Agent-D567: File ops + SSRF + Crypto Agent-D89: Config + Business logic Agent-D10: Supply chain Estimated: 125 turns, 90-120 minutes Proceed? (yes/no) ``` ### Language-Specific Patterns #### Java/Spring Boot Audit ```java // The skill will identify patterns like: // VULNERABLE: SQL Injection @GetMapping("/users") public List<User> getUsers(@RequestParam String name) { String sql = "SELECT * FROM users WHERE name = '" + name + "'"; return jdbcTemplate.query(sql, new UserRowMapper()); } // VULNERABLE: Missing authorization @GetMapping("/admin/users/{id}") public User getUser(@PathVariable Long id) { return userRepository.findById(id).orElseThrow(); // No @PreAuthorize check } // VULNERABLE: Insecure deserialization @PostMapping("/import") public void importData(@RequestBody byte[] data) { ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data)); Object obj = ois.readObject(); // Dangerous! } ``` **Audit command:** ``` Review this Spring Boot application for injection flaws, missing authorization checks, and unsafe deserialization ``` #### Python/Flask Audit ```python # The skill will detect: # VULNERABLE: Command injection @app.route('/ping') def ping(): host = request.args.get('host') result = os.system(f'ping -c 4 {host}') # No sanitization return str(result) # VULNERABLE: SQL injection @app.route('/search') def search(): query = request.args.get('q') sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'" return db.execute(sql).fetchall() # VULNERABLE: Path traversal @app.route('/download/<path:filename>') def download(filename): return send_file(f'/uploads/{filename}') # No path validation ``` **Audit command:** ``` Scan this Flask app for command injection and path traversal vulnerabilities ``` #### PHP/Laravel Audit ```php // The skill will identify: // VULNERABLE: SQL injection via raw queries public function search(Request $request) { $keyword = $request->input('keyword'); $users = DB::select("SELECT * FROM users WHERE name = '$keyword'"); return view('results', ['users' => $users]); } // VULNERABLE: Mass assignment public function updateProfile(Request $request) { $user = User::find($request->user_id); $user->update($request->all()); // Can modify is_admin, role, etc. } // VULNERABLE: Insecure file upload public function upload(Request $request) { $file = $request->file('avatar'); $path = $file->store('public/avatars'); // No type validation } ``` **Audit command:** ``` Audit this Laravel application for SQL injection and mass assignment issues ``` #### JavaScript/Node.js Audit ```javascript // The skill will detect: // VULNERABLE: NoSQL injection app.get('/login', async (req, res) => { const { username, password } = req.query; const user = await User.findOne({ username: username, password: password // Can be {"$ne": null} }); }); // VULNERABLE: Command injection app.post('/convert', (req, res) => { const { file } = req.body; exec(`convert ${file} output.png`, (err, stdout) => { res.send(stdout); }); }); // VULNERABLE: Prototype pollution app.post('/merge', (req, res) => { const obj = {}; merge(obj, req.body); // Can set __proto__ }); ``` **Audit command:** ``` Check this Express app for NoSQL injection and prototype pollution ``` ## Helper Scripts ### Pattern Scanner ```bash # Scan for dangerous patterns python scripts/pattern_scanner.py /path/to/project --language java --output patterns.json # Focus on specific dimensions python scripts/pattern_scanner.py /path/to/project --dimensions D1,D4,D5 ``` ### Data Flow Analyzer ```bash # Trace data flows for specific sources python scripts/data_flow_analyzer.py /path/to/project \ --source "request.getParameter" \ --sink "executeQuery" # Output taint paths python scripts/data_flow_analyzer.py /path/to/project \ --output dataflow.json \ --visualize ``` ### Secret Finder ```bash # Detect hardcoded secrets python scripts/secret_finder.py /path/to/project # Custom patterns python scripts/secret_finder.py /path/to/project \ --patterns custom_patterns.yaml \ --entropy-threshold 4.5 ``` ### Dependency Analyzer ```bash # Check for vulnerable dependencies python scripts/dependency_analyzer.py /path/to/project # Specific package managers python scripts/dependency_analyzer.py /path/to/project \ --package-manager maven,npm \ --severity high,critical ``` ### Full Audit with Report ```bash # Complete audit pipeline python scripts/code_scan.py /path/to/project \ --mode deep \ --output results.json # Generate formatted report python scripts/report_generator.py \ --input results.json \ --output audit_report.md \ --template templates/report-templates/web-app-report-template.md ``` ## Configuration ### Audit Configuration File Create `.dfyx_audit.yaml` in your project root: ```yaml # Audit configuration mode: deep # quick, standard, deep # Scope scope: include: - "src/**/*.java" - "controllers/**/*.py" exclude: - "test/**" - "vendor/**" - "node_modules/**" # Dimensions to cover dimensions: - D1 # Injection - D2 # Authentication - D3 # Authorization - D4 # Deserialization - D5 # File Operations - D6 # SSRF - D7 # Cryptography - D8 # Configuration - D9 # Business Logic - D10 # Supply Chain # Sensitivity levels severity_threshold: medium # low, medium, high, critical # Framework-specific settings frameworks: spring: check_shiro_bypass: true check_spel_injection: true django: check_template_injection: true check_orm_injection: true # Anti-hallucination settings validation: require_evidence: true require_full_path: true require_poc: true # For high/critical findings cross_validate: true # Multi-agent validation # Reporting report: format: markdown # markdown, json, html include_fix_examples: true include_attack_chains: true language: en # en, zh ``` ### Environment Variables ```bash # For Docker-based verification export DOCKER_HOST=unix:///var/run/docker.sock # For dependency vulnerability scanning export NVD_API_KEY=${NVD_API_KEY} # NIST NVD API key export GITHUB_TOKEN=${GITHUB_TOKEN} # For GitHub Advisory Database # For custom tool integration export SEMGREP_RULES_PATH=/path/to/custom/rules export CODEQL_DATABASE_PATH=/path/to/codeql/db ``` ## Common Audit Scenarios ### Pre-commit Security Check ```bash # Quick mode for fast feedback python scripts/code_scan.py . --mode quick --staged-only # In Git hooks (.git/hooks/pre-commit) #!/bin/bash python scripts/code_scan.py . --mode quick --fail-on critical,high if [ $? -ne 0 ]; then echo "Security issues found. Commit aborted." exit 1 fi ``` ### CI/CD Integration ```yaml # .github/workflows/security-audit.yml name: Security Audit on: [push, pull_request] jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Setup Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Install dependencies run: pip install -r requirements.txt - name: Run security audit run: |