| name | source-code-audit |
| description | Performs whitebox static application security testing (SAST), code review, API route extraction, credential hunting, and vulnerability pattern detection in local repositories or GitHub codebases. |
Source Code Audit Skill (SAST & Whitebox Security)
Purpose
Simulate advanced whitebox penetration testing by inspecting source code repositories, extracting application routes, detecting insecure database queries, identifying weak authentication/authorization logic, and locating hardcoded secrets.
Core Capabilities
- Route & Controller Mapping: Map all public and internal API endpoints (Express, Django, Flask, FastAPI, Spring Boot, Laravel, Next.js).
- Injection Flaws Detection: Scan for unsanitized SQL, command execution (
eval, exec, os.system), template injection (Jinja2, Thymeleaf), and XPath/LDAP queries.
- Authorization & Access Control: Analyze middleware, RBAC checks, and missing object-level permission guards (IDOR).
- Secret & Key Hunting: Fast regex and entropy scanning for credentials, JWT secrets, and third-party API keys using
trufflehog and ripgrep.
Workflow
1. Codebase Profiling
Identify technology stack, framework, database connectors, and dependency manifests:
find . -maxdepth 3 -name "package.json" -o -name "requirements.txt" -o -name "pom.xml" -o -name "composer.json" -o -name "go.mod"
2. Secret & Sensitive Data Extraction
Run fast local entropy search for leaked credentials:
