dfyx-code-security-review

name	dfyx-code-security-review
description	Expert-level code security audit skill using deep data flow analysis and business logic understanding for white-box static analysis across 9 languages
triggers	["audit this codebase for security vulnerabilities","perform a security code review","find security issues in this project","analyze code for OWASP vulnerabilities","check for injection flaws and authentication issues","run a deep security audit","scan for SQL injection and RCE vulnerabilities","review code security following OWASP Top 10"]

dfyx-code-security-review

Skill by ara.so — Security Skills collection.

A professional code security audit skill designed for AI coding agents, implementing a five-phase standardized audit protocol with dual-track analysis (Sink-driven, Control-driven, Config-driven) to systematically discover and validate security vulnerabilities in source code.

Overview

dfyx_code_security_review provides expert-level white-box static analysis capabilities covering:

• 9 Languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust
• 10 Security Dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain
• 14 Frameworks: Spring Boot, Django, Flask, FastAPI, Express, Koa, Gin, Laravel, Rails, ASP.NET Core, Rust Web, NestJS/Fastify, MyBatis, ProcessWire

Installation

Clone the repository and integrate with your AI coding agent:

# Clone the project
git clone https://github.com/EastSword/skill-dfyx_code_security_review.git

# For Claude Code
cp -r skill-dfyx_code_security_review ~/.claude/skills/

# Install Python dependencies (optional, for standalone scripts)
cd skill-dfyx_code_security_review
pip install -r requirements.txt

Core Methodology

Five-Phase Audit Protocol

Phase 1: Reconnaissance & Mapping (10%)
    ├─ Technology stack identification
    ├─ Architecture diagram generation
    └─ Attack surface enumeration

Phase 2: Parallel Pattern Matching (30%)
    ├─ Sink-driven scanning (dangerous functions)
    ├─ Control-driven scanning (missing security controls)
    └─ Config-driven scanning (misconfigurations)

Phase 3: Deep Taint Tracking & Practical Testing (40%)
    ├─ Data flow analysis
    ├─ Path-sensitive analysis
    └─ POC generation and verification

Phase 4: Validation & Attack Chain Construction (15%)
    ├─ Vulnerability validation
    ├─ Attack chain analysis
    └─ Exploitability assessment

Phase 5: Structured Reporting (5%)
    ├─ Vulnerability documentation
    ├─ Remediation guidance
    └─ Risk prioritization

Dual-Track Audit Model

Track	Dimensions	Method	Target
Sink-driven	D1 Injection, D4 Deserialization, D5 File Ops, D6 SSRF	Grep dangerous functions → Trace data flow → Verify no protection	Existing dangerous code
Control-driven	D3 Authorization, D9 Business Logic	Enumerate endpoints → Verify security controls exist → Missing = Vulnerability	Missing security controls
Config-driven	D2 Authentication, D7 Crypto, D8 Config, D10 Supply Chain	Search configs → Compare security baseline	Misconfigurations

Security Dimensions

#	Dimension	Coverage
D1	Injection	SQL/Command/LDAP/SSTI/SpEL/JNDI/XPath/XML injection
D2	Authentication	Token/Session/JWT/Filter chain vulnerabilities
D3	Authorization	CRUD consistency, IDOR, horizontal privilege escalation
D4	Deserialization	Java/Python/PHP gadget chains, unsafe deserialization
D5	File Operations	Upload/download/path traversal vulnerabilities
D6	SSRF	URL injection, protocol bypass
D7	Cryptography	Key management, weak algorithms, improper KDF
D8	Configuration	Actuator exposure, CORS, error disclosure
D9	Business Logic	Race conditions, mass assignment, state machine flaws
D10	Supply Chain	Dependency CVEs, outdated packages

Scan Modes

Mode	Use Case	Scope	Time
Quick	CI/CD, small projects	Critical vulns, secrets, dependency CVEs	5-10 min
Standard	Regular audits	OWASP Top 10, auth/authz, crypto	30-60 min
Deep	Critical projects, pentest prep	Full coverage, attack chains, business logic	1-3 hours

Usage Patterns

Basic Audit Request

Trigger an audit using natural language:

"Audit this codebase for security vulnerabilities"
"Perform a deep security review of this Spring Boot project"
"Find SQL injection and authentication issues"

The agent will respond with:

[MODE] deep
[RECON] 874 files, Spring Boot 1.5 + Shiro 1.6 + JPA + Freemarker
[PLAN] 5 Agents, D1-D10 coverage, estimated 125 turns
[SCOPE] Focus areas: Authentication, SQL Injection, Deserialization
Confirm to start audit? (yes/no)

Code Examples

SQL Injection Detection (Java)

Vulnerable Code:

// UserController.java
@GetMapping("/user/search")
public List<User> searchUser(@RequestParam String username) {
    String sql = "SELECT * FROM users WHERE username = '" + username + "'";
    return jdbcTemplate.query(sql, new UserRowMapper());
}

Detection Process:

1. [SINK] Identified dangerous sink: jdbcTemplate.query()
2. [SOURCE] Traced user input: @RequestParam username
3. [DATAFLOW] username → sql concatenation → jdbcTemplate.query()
4. [VALIDATION] No PreparedStatement, no input validation
5. [VULNERABILITY] SQL Injection (Critical)

Remediation:

// Fixed version
@GetMapping("/user/search")
public List<User> searchUser(@RequestParam String username) {
    String sql = "SELECT * FROM users WHERE username = ?";
    return jdbcTemplate.query(sql, new Object[]{username}, new UserRowMapper());
}

Command Injection Detection (Python)

Vulnerable Code:

# utils.py
import subprocess

def ping_host(host):
    cmd = f"ping -c 4 {host}"
    result = subprocess.call(cmd, shell=True)
    return result

Detection Process:

1. [SINK] Identified dangerous sink: subprocess.call(shell=True)
2. [SOURCE] Traced user input: host parameter
3. [DATAFLOW] host → f-string interpolation → subprocess.call()
4. [VALIDATION] No input sanitization, shell=True enables injection
5. [VULNERABILITY] Command Injection (Critical)

Remediation:

# Fixed version
import subprocess
import shlex

def ping_host(host):
    # Validate host format
    if not re.match(r'^[a-zA-Z0-9.-]+$', host):
        raise ValueError("Invalid host format")
    
    # Use list instead of shell
    result = subprocess.call(['ping', '-c', '4', host])
    return result

Authorization Bypass Detection (Node.js)

Vulnerable Code:

// routes/api.js
router.get('/admin/users', (req, res) => {
    // Missing authorization check
    const users = db.getAllUsers();
    res.json(users);
});

router.delete('/admin/user/:id', (req, res) => {
    // Missing authorization check
    db.deleteUser(req.params.id);
    res.json({success: true});
});

Detection Process:

1. [CONTROL] Enumerated admin endpoints: /admin/users, /admin/user/:id
2. [CHECK] Searched for middleware: auth.isAdmin, requireAdmin
3. [MISSING] No authorization middleware found
4. [VALIDATION] Direct access possible without admin role
5. [VULNERABILITY] Missing Authorization (High)

Remediation:

// Fixed version
const requireAdmin = (req, res, next) => {
    if (!req.user || req.user.role !== 'admin') {
        return res.status(403).json({error: 'Forbidden'});
    }
    next();
};

router.get('/admin/users', requireAdmin, (req, res) => {
    const users = db.getAllUsers();
    res.json(users);
});

router.delete('/admin/user/:id', requireAdmin, (req, res) => {
    db.deleteUser(req.params.id);
    res.json({success: true});
});

Deserialization Vulnerability (Java)

Vulnerable Code:

// DataProcessor.java
public Object processData(String base64Data) {
    byte[] data = Base64.getDecoder().decode(base64Data);
    ObjectInputStream ois = new ObjectInputStream(
        new ByteArrayInputStream(data)
    );
    return ois.readObject(); // Unsafe deserialization
}

Detection Process:

1. [SINK] Identified dangerous sink: ObjectInputStream.readObject()
2. [SOURCE] Traced user input: base64Data parameter
3. [DATAFLOW] base64Data → Base64 decode → readObject()
4. [GADGET] Checked classpath for known gadget chains (Commons-Collections)
5. [VULNERABILITY] Unsafe Deserialization → RCE (Critical)

Remediation:

// Fixed version using safe alternatives
public Map<String, Object> processData(String jsonData) {
    ObjectMapper mapper = new ObjectMapper();
    // Use JSON instead of Java serialization
    return mapper.readValue(jsonData, 
        new TypeReference<Map<String, Object>>(){});
}

// OR use whitelist if serialization is required
public Object processData(String base64Data) {
    byte[] data = Base64.getDecoder().decode(base64Data);
    ValidatingObjectInputStream vois = new ValidatingObjectInputStream(
        new ByteArrayInputStream(data)
    );
    // Whitelist allowed classes
    vois.accept(SafeClass.class, AnotherSafeClass.class);
    return vois.readObject();
}

Path Traversal Detection (PHP)

Vulnerable Code:

// download.php
<?php
$file = $_GET['file'];
$path = "/var/www/uploads/" . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}
?>

Detection Process:

1. [SINK] Identified file operation: readfile()
2. [SOURCE] Traced user input: $_GET['file']
3. [DATAFLOW] $_GET['file'] → concatenation → readfile()
4. [VALIDATION] No path sanitization, allows "../" sequences
5. [ATTACK] Payload: ?file=../../../etc/passwd
6. [VULNERABILITY] Path Traversal (High)

Remediation:

// Fixed version
<?php
function sanitizeFilename($filename) {
    // Remove directory traversal sequences
    $filename = str_replace(['../', '..\\'], '', $filename);
    // Only allow alphanumeric, dash, underscore, dot
    $filename = preg_replace('/[^a-zA-Z0-9._-]/', '', $filename);
    return basename($filename);
}

$file = sanitizeFilename($_GET['file']);
$path = "/var/www/uploads/" . $file;

// Verify file is within allowed directory
$realpath = realpath($path);
if ($realpath && strpos($realpath, '/var/www/uploads/') === 0 && file_exists($realpath)) {
    header('Content-Type: application/octet-stream');
    readfile($realpath);
} else {
    http_response_code(404);
     ;
}

Standalone Script Usage

For command-line execution:

# Full scan
python scripts/code_scan.py /path/to/project --mode deep --output results.json

# Quick scan (CI/CD)
python scripts/code_scan.py /path/to/project --mode quick

# Focus on specific dimensions
python scripts/code_scan.py /path/to/project --dimensions D1,D2,D3

# Secret detection only
python scripts/secret_finder.py /path/to/project

# Dependency vulnerability check
python scripts/dependency_analyzer.py /path/to/project

# Generate report
python scripts/report_generator.py --input results.json --output report.md

Python API Usage

from scripts.code_scan import SecurityScanner
from scripts.data_flow_analyzer import DataFlowAnalyzer

# Initialize scanner
scanner = SecurityScanner(project_path='/path/to/project', mode='deep')

# Run scan
results = scanner.scan()

# Analyze specific vulnerability
dfa = DataFlowAnalyzer(project_path='/path/to/project')
flow = dfa.trace_taint(
    source='request.getParameter("id")',
    sink='jdbcTemplate.query(sql)',
    file='UserController.java'
)

# Generate report
scanner.generate_report(results, output_file='security_report.md')

Configuration

Environment Variables

# Set audit mode
export DFYX_AUDIT_MODE=deep  # quick|standard|deep

# Enable Docker verification
export DFYX_DOCKER_VERIFY=true

# Set report output format
export DFYX_REPORT_FORMAT=markdown  # markdown|json|html

# Configure parallel agents
export DFYX_AGENTS=5

# Set vulnerability severity threshold
export DFYX_MIN_SEVERITY=medium  # low|medium|high|critical

Custom Rules Configuration

Create custom_rules.yaml:

custom_rules:
  - id: CUSTOM_001
    name: "Internal API Key Exposure"
    pattern: 'INTERNAL_API_KEY\s*=\s*["\'][^"\']+["\']'
    severity: critical
    language: [python, javascript]
    
  - id: CUSTOM_002
    name: "Unsafe Eval Usage"
    pattern: '\beval\s*\('
    severity: high
    language: [javascript, python]
    
  - id: CUSTOM_003
    name: "Missing CSRF Protection"
    pattern: '@PostMapping.*\n(?!.*@CsrfToken)'
    severity: medium
    language: [java]

Load custom rules:

python scripts/code_scan.py /path/to/project --rules custom_rules.yaml

Report Structure

Generated Report Sections

1. Executive Summary

   • Total vulnerabilities by severity
   • Critical findings summary
   • Risk score

2. Vulnerability Details

   • Code location with line numbers
   • Data flow diagram
   • Exploitation POC
   • Remediation code examples

3. Attack Chain Analysis

   • Multi-stage attack scenarios
   • Combined vulnerability exploitation

4. Dependency Analysis

   • Known CVEs in dependencies
   • Outdated package versions
   • License compliance

5. Secrets Detection

   • API keys, passwords in code
   • Hard-coded credentials
   • Environment leakage

Common Patterns

Pattern 1: SQL Injection in ORM

# Django vulnerable pattern
def search_users(request):
    query = request.GET.get('q')
    # Raw SQL with format string - VULNERABLE
    users = User.objects.raw(
        f"SELECT * FROM users WHERE name LIKE '%{query}%'"
    )
    return render(request, 'users.html', {'users': users})

# Fixed version
def search_users(request):
    query = request.GET.get('q')
    # Use parameterized query
    users = User.objects.raw(
        "SELECT * FROM users WHERE name LIKE %s",
        [f'%{query}%']
    )
    return render(request, 'users.html', {'users': users})

Pattern 2: JWT Authentication Bypass

// Vulnerable JWT validation
function verifyToken(token) {
    try {
        // Using 'none' algorithm vulnerable to bypass
        const decoded = jwt.decode(token, {complete: true});
        if (decoded.payload.admin) {
            return decoded.payload;
        }
    } catch(e) {
        return null;
    }
}

// Fixed version
function verifyToken(token) {
    try {
        // Verify signature with secret
        const decoded = jwt.verify(token, process.env.JWT_SECRET, {
            algorithms: ['HS256'] // Whitelist allowed algorithms
        });
        if (decoded.admin === true) {
            return decoded;
        }
    } catch(e) {
        return null;
    }
}

Pattern 3: IDOR in REST API

// Vulnerable controller
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId) {
    // Missing authorization check - any user can access any order
    return orderService.findById(orderId);
}

// Fixed version
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId, 
                      @AuthenticationPrincipal User currentUser) {
    Order order = orderService.findById(orderId);
    
    // Verify order belongs to current user
    if (!order.getUserId().equals(currentUser.getId()) && 
        !currentUser.isAdmin()) {
        throw new AccessDeniedException("Cannot access this order");
    }
    
    return order;
}

Pattern 4: XXE in XML Parsing

// Vulnerable XML parser
public Document parseXML(String xmlString) {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    DocumentBuilder builder = factory.newDocumentBuilder();
    return builder.parse(new InputSource(new StringReader(xmlString)));
}

// Fixed version
public Document parseXML(String xmlString) {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    
    // Disable external entities
    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
    factory.setExpandEntityReferences(false);
    
    DocumentBuilder builder = factory.newDocumentBuilder();
    return builder.parse(new InputSource(new StringReader(xmlString)));
}

Pattern 5: Race Condition in Balance Transfer

# Vulnerable transfer function
def transfer_money(from_account, to_account, amount):
    # Race condition: multiple concurrent transfers can overdraw
    balance = get_balance(from_account)
    if balance >= amount:
        time.sleep(0.1)  # Simulate processing delay
        decrease_balance(from_account, amount)
        increase_balance(to_account, amount)
        return True
    return False

# Fixed version with transaction lock
from django.db import transaction

@transaction.atomic
def transfer_money(from_account, to_account, amount):
    # Use select_for_update to lock row
    account = Account.objects.select_for_update().get(id=from_account)
    
    if account.balance >= amount:
        account.balance -= amount
        account.save()
        
        recipient = Account.objects.select_for_update().get(id=to_account)
        recipient.balance += amount
        recipient.save()
        return True
    return False

Troubleshooting

Issue: High False Positive Rate

Solution:

# Enable stricter validation
export DFYX_VALIDATION_MODE=strict

# Require POC generation for all findings
export DFYX_REQUIRE_POC=true

# Run with actual testing verification
python scripts/code_scan.py /path/to/project --verify-with-tests

Issue: Missing Framework-Specific Vulnerabilities

Solution:

# Enable framework-aware analysis
python scripts/code_scan.py /path/to/project --framework spring-boot

# Add framework-specific rules
python scripts/code_scan.py /path/to/project --rules resources/rules/spring_security_rules.yaml

Issue: Slow Scan Performance

Solution:

# Use quick mode for CI/CD
python scripts/code_scan.py /path/to/project --mode quick

# Increase parallel agents
export DFYX_AGENTS=10

# Exclude test files
python scripts/code_scan.py /path/to/project --exclude "**/test/**,**/tests/**"

Issue: Cannot Trace Complex Data Flow

Solution:

# Enable enhanced taint analysis
python scripts/code_scan.py /path/to/project --enhanced-taint

# Increase analysis depth
export DFYX_TAINT_DEPTH=10

# Manual data flow analysis
python scripts/data_flow_analyzer.py \
    --source "HttpServletRequest.getParameter" \
    --sink "Runtime.exec" \
    --file "VulnerableController.java"

Anti-Hallucination Mechanisms

The skill implements strict evidence requirements:

1. Code Evidence: Must provide exact file path and line numbers
2. Data Flow Path: Must trace complete source → sink path
3. POC Generation: Must demonstrate actual exploitability
4. Docker Verification: Optional containerized validation

# Enable all anti-hallucination checks
export DFYX_ANTI_HALLUCINATION=true
export DFYX_REQUIRE_EVIDENCE=true
export DFYX_DOCKER_VERIFY=true

Integration with CI/CD

GitHub Actions

name: Security Audit
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
      
      - name: Install dfyx
        run: |
          git clone https://github.com/EastSword/skill-dfyx_code_security_review.git
          cd skill-dfyx_code_security_review
          pip install -r requirements.txt
      
      - name: Run Security Scan
        run: |
          python skill-dfyx_code_security_review/scripts/code_scan.py . \
            --mode quick \
            --output results.json \
            --min-severity high
      
      - name: Upload Results
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: results.json

GitLab CI

security-audit:
  stage: test
  image: python:3.10
  script:
    - git clone https://github.com/EastSword/skill-dfyx_code_security_review.git
    - cd skill-dfyx_code_security_review && pip install -r requirements.txt
    - cd .. && python skill-dfyx_code_security_review/scripts/code_scan.py . --mode quick
  artifacts:
    paths:
      - security_report.md
    expire_in: 1 week

Advanced Features

Attack Chain Analysis

The skill automatically identifies vulnerability combinations:

Attack Chain #1: Admin Account Takeover
├─ [Step 1] IDOR in /api/user/{id} (No authorization check)
├─ [Step 2] User enumeration via timing attack
├─ [Step 3] Password reset token prediction (weak randomness)
└─ [Impact] Full admin account compromise

POC:
1. Enumerate admin user ID: GET /api/user/1 (returns admin profile)
2. Trigger password reset: POST /api/reset-password {userId: 1}
3. Predict token using timestamp + user ID
4. Reset admin password: POST /api/confirm-reset {token: predicted}

Business Logic Vulnerability Detection

# Example: Discount code reuse vulnerability
@app.route('/apply-discount', methods=['POST'])
def apply_discount():
    code = request.json['code']
    # Missing: check if code already used by this user
    discount = DiscountCode.query.filter_by(code=code).first()
    if discount:
        session['discount'] = discount.percentage
        return {'success': True}

Detection:

[BUSINESS_LOGIC] Missing state validation
├─ Endpoint: /apply-discount
├─ Issue: No check for duplicate discount code usage
├─ Impact: User can apply same discount code multiple times
└─ Fix: Add user-code usage tracking table

WooYun Case Database

The skill includes 1000+ real-world vulnerability cases from WooYun (2010-2016):

# Search WooYun cases for similar vulnerabilities
python scripts/code_scan.py /path/to/project --with-wooyun-cases

# Output will reference similar cases
# "Similar to WooYun-2016-12345: Dedecms SQL Injection in article.php"

Best Practices

1. Pre-Audit Checklist

   • Ensure complete source code access
   • Identify all entry points (APIs, forms, file uploads)
   • Document authentication mechanisms
   • List third-party dependencies

2. During Audit

   • Confirm each finding with POC
   • Test in isolated environment
   • Document data flow with diagrams
   • Prioritize by exploitability + impact

3. Post-Audit

   • Validate all remediation code
   • Re-scan after fixes
   • Add to regression test suite
   • Update threat model

License

MIT License - Free for security research and educational purposes only.

Resources

• Documentation: resources/knowledge/ (13 knowledge base documents)
• Rule Sets: resources/rules/ (vulnerability detection patterns)
• WooYun Cases: resources/wooyun/wooyun_cases_by_vulnerability_type.md
• Templates: templates/report-templates/ (standard report formats)
• Examples: examples/ (audit examples and POCs)

For issues or contributions, visit: https://github.com/EastSword/skill-dfyx_code_security_review