Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
“代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践”
Install Security Audit
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install laolaoshiren/claude-code-skills-zh security-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/security-audit .claude/skills/security-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .claude/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install laolaoshiren/claude-code-skills-zh security-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/security-audit .agents/skills/security-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .agents/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install laolaoshiren/claude-code-skills-zh security-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/security-audit .cursor/skills/security-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .cursor/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/laolaoshiren/claude-code-skills-zh.git --path skills/security-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install laolaoshiren/claude-code-skills-zh security-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/security-audit .gemini/skills/security-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .gemini/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install laolaoshiren/claude-code-skills-zh security-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/security-audit .github/skills/security-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .github/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install laolaoshiren/claude-code-skills-zh security-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zh.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/security-audit .opencode/skills/security-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-audit" agent skill from https://github.com/laolaoshiren/claude-code-skills-zh/tree/main/skills/security-audit into .opencode/skills/security-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-audit- GitHub stars
- 880
- Token cost
- ~282 tokens
- SKILL.md length
- 71 words
- Files
- 1
- Skills in repo
- 19
- Repo updated
- First seen
- Licence
- MIT
At a glance
- Works in 4 steps: 确定审计范围 — 根据用户指定的目录/文件/代码段进行分析 → 静态安全扫描 — 按检查清单逐项排查 → 依赖安全检查 — 检查 package.json /… → …
- SKILL.md covers 触发条件, 工作流程, 检查清单 and 输出格式
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
About this skill
Security Audit is a skill in laolaoshiren/claude-code-skills-zh (880 stars). Its SKILL.md is about 282 tokens. Licence: MIT.
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- 确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
- 静态安全扫描 — 按检查清单逐项排查
- 依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
- 生成审计报告 — 按严重程度分类输出
What it can do on your machine
Read from SKILL.md and the folder at commit 633f21c. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Audit loads about 282 tokens when it runs. Until then it costs about 10 tokens; SKILL.md has 71 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from laolaoshiren/claude-code-skills-zh at commit 633f21c, republished under its MIT licence (© laolaoshiren). 71 words, ~282 tokens.
Download SKILL.mdSave it as
.claude/skills/security-audit/SKILL.md (or your agent's skills folder).- name
- security-audit
- description
- 代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践
代码安全审计
触发条件
当用户要求安全检查、漏洞扫描、安全审计、依赖安全检查时激活此技能。
工作流程
- 确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
- 静态安全扫描 — 按检查清单逐项排查
- 依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
- 生成审计报告 — 按严重程度分类输出
检查清单
🔴 高危
- 硬编码密钥/密码/API Key
- SQL 注入风险（字符串拼接 SQL）
- 命令注入（未过滤的 shell 命令）
- 路径遍历（未校验的文件路径）
- 反序列化漏洞
- 未校验的 JWT/Token 验证
🟡 中危
- XSS 风险（未转义的用户输入）
- CSRF 保护缺失
- 不安全的随机数生成
- 敏感信息日志泄露
- 过宽的权限设置
- 缺少 Rate Limiting
🟢 低危
- 缺少输入验证
- 依赖版本过旧
- 缺少安全头部（CSP, HSTS, X-Frame-Options）
- 错误信息泄露内部细节
- 缺少 HTTPS 强制
输出格式
## 🔒 安全审计报告
### 审计概览
- 审计范围：xxx
- 发现问题：🔴 高危 X 个 / 🟡 中危 X 个 / 🟢 低危 X 个
### 🔴 高危问题
#### 1. [文件路径:行号]
- **漏洞类型**：xxx
- **风险描述**：xxx
- **攻击场景**：攻击者可以通过 xxx 方式...
- **修复方案**：
```code
// 修复前
// 修复后🟡 中危问题
...
🟢 低危问题
...
依赖安全
| 依赖名 | 当前版本 | 建议版本 | 风险 |
|---|
修复优先级建议
- 立即修复：...
- 本周修复：...
- 长期改进：...
## 注意事项
- 提供修复前后的代码对比
- 对于每条漏洞，说明具体的攻击向量
- 优先级基于可利用性和影响范围判断© laolaoshiren, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/security-audit of laolaoshiren/claude-code-skills-zh.
Open the folder on GitHubat commit 633f21c
Compare with similar skills
Security Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Audit this skilllaolaoshiren/claude-code-skills-zh | 880 | — | ~282 | Automated safety check: Pass | MIT | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Kubernetes Network Security Auditkubeshark/kubeshark | 12k | — | ~7.3k | Automated safety check: Notes | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Semgrep Security Scantrailofbits/skills | 7.5k | — | ~3.7k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Skillward AuditFangcun-AI/SkillWard | 143 | — | ~2.9k | Automated safety check: Pass | Custom licence |
Similar skills
- Official
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
- Official
Semgrep Security Scan
trailofbits/skills
Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.
Skillward Audit
Fangcun-AI/SkillWard
Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
More from laolaoshiren/claude-code-skills-zh
All 19 skills in this repoAPI Tester
laolaoshiren/claude-code-skills-zh
依据真实 OpenAPI、路由实现和现有测试生成并验证 API 测试。用于用户要求测试接口、补集成测试、验证 API 契约、生成回归用例或排查接口兼容性时；区分“生成测试”和“执行请求”的授权，不猜测状态码、响应结构或 SLA，不在未确认环境中发送写请求。
Dep Auditor
laolaoshiren/claude-code-skills-zh
审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报告时使用
Eslint Fix
laolaoshiren/claude-code-skills-zh
安全诊断并修复 ESLint error、warning 和配置兼容问题。用于用户要求运行 lint、解释 ESLint 报错、限定范围自动修复或迁移 ESLint 配置时；优先使用项目锁定的包管理器与版本，先预检再修改，不自动下载最新版或批量改写无关源码。
Git Workflow
laolaoshiren/claude-code-skills-zh
安全处理 Git 状态检查、提交信息、commit、分支、push、PR 和 rebase。用于用户要求检查改动、生成或创建提交、管理分支、推送、发起 PR 或整理历史时；严格区分每个动作的授权，并保护工作树中已有和无关的修改。
GitHub Actions Gen
laolaoshiren/claude-code-skills-zh
分析真实项目并生成或修订安全、可验证的 GitHub Actions workflow；当用户要求创建 CI、测试矩阵、构建、Release、部署、缓存、Secrets、OIDC、PR 自动化或排查 workflow 配置时使用
Skill Curator
laolaoshiren/claude-code-skills-zh
中文 Skill 收录评估器。用于核验 GitHub 上的 Claude Code、Codex、Agent Skills、Plugin、MCP、CLI 或 Agent 工作流是否值得加入精选列表；检查真实资产、安装方式、活跃度、重复项和安全边界，并生成分类、中文描述与可追溯证据。
Related
Categories
Questions about Security Audit
How do I install Security Audit in Claude Code?
Run `npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a claude-code`. Or copy the skill folder (skills/security-audit in laolaoshiren/claude-code-skills-zh) into .claude/skills/security-audit in your project. Claude Code loads it when a task matches its description.
How do I install Security Audit in Codex?
Run `npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a codex`. Or copy the skill folder (skills/security-audit in laolaoshiren/claude-code-skills-zh) into .agents/skills/security-audit in your project. Codex loads it when a task matches its description.
Can I use Security Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add laolaoshiren/claude-code-skills-zh --skill security-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-audit, .gemini/skills/security-audit, .github/skills/security-audit and .opencode/skills/security-audit in your project.
What does Security Audit need to run?
SKILL.md names no scripts, command-line tools or credentials: Security Audit is instructions for the agent only.
Does Security Audit access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Security Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Audit use?
Security Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Audit use?
About 282 tokens (SKILL.md is roughly 1.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Audit?
Skills that share tags, products or a category with Security Audit: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Native Dependency Update (mono/SkiaSharp, 5.6k stars) and Semgrep Security Scan (trailofbits/skills, 7.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Audit?
laolaoshiren (a GitHub user) maintains it in laolaoshiren/claude-code-skills-zh, which has 880 GitHub stars. The repository holds 19 skills in this directory. The repository was last updated on October 5, 2026.
Source: laolaoshiren/claude-code-skills-zh on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.