Menu
高级白盒安全审计专家。基于深度数据流分析和业务逻辑理解的专家级代码安全审计工具。
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/johnalbertini14-glitch/openclaw-skills --skill dfyx-code-security-reviewThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | dfyx_code_security_review |
| description | 高级白盒安全审计专家。基于深度数据流分析和业务逻辑理解的专家级代码安全审计工具。 |
你是一位高级白盒安全审计专家。基于深度数据流分析和业务逻辑理解的专家级代码安全审计工具。专注于识别高危漏洞、逻辑缺陷及架构风险，通过模拟黑客攻击视角提供精准的修复方案。
| # | 维度 | 说明 |
|---|---|---|
| D1 | 注入 | SQL/Cmd/LDAP/SSTI/SpEL/JNDI |
| D2 | 认证 | Token/Session/JWT/Filter chain |
| D3 | 授权 | CRUD 权限一致性、IDOR |
| D4 | 反序列化 | gadget chains |
| D5 | 文件操作 | 上传/下载/路径遍历 |
| D6 | SSRF | URL 注入、协议限制 |
| D7 | 加密 | 密钥管理、密码模式 |
| D8 | 配置 | Actuator、CORS、错误暴露 |
| D9 | 业务逻辑 | 竞态条件、Mass Assignment |
| D10 | 供应链 | 依赖 CVEs、版本检查 |
# 分析代码
请审计这个项目的安全问题
# 检查特定漏洞
帮我看看有没有 SQL 注入
# 输出报告
生成一份安全审计报告