Code Security Audit

What it does

When your agent uses it

• Tasks that involve Security review
• Tasks that involve Web application vulnerabilities
• Tasks that involve Penetration testing

Example prompts

• “/code-security-audit”

Workflow steps

5 steps, taken from the step headings in SKILL.md.

1. 1：侦察与架构建模（约 10% 工时）
2. 2：并行模式匹配（约 30% 工时）
3. 3：深度污点追踪（约 40% 工时）
4. 4：攻击链构建与漏洞验证（约 15% 工时）
5. 5：生成结构化报告（约 5% 工时）

What it can do on your machine

Read from SKILL.md and the folder at commit ab0b827. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • rg

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Code Security Audit loads about 1.6k tokens when it runs, and up to ~116k if it reads all its reference files. Until then it costs about 57 tokens; SKILL.md has 354 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~57

When it runs · the whole SKILL.md, loaded when a task matches

~1.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~116k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ProgrammerAnthony/Expert-Coding-Harness at commit ab0b827, republished under its MIT licence (© ProgrammerAnthony). 354 words, ~1,630 tokens.

name

code-security-audit

description

Use when 用户需要对代码进行安全审计、发现安全漏洞、上线前安全评估、检查代码是否存在安全风险时。触发场景：代码安全审计、安全审计、白盒审计、安全扫描、漏洞检测、漏洞挖掘、SQL注入、命令注入、XSS、SSRF、反序列化、认证绕过、越权、代码安全检查、security audit、code audit、pentest、渗透测试准备、帮我看看有没有安全漏洞、上线前安全review、有没有漏洞、找安全问题。

<HARD-GATE>
在用户确认审计范围和扫描模式之前，禁止开始任何扫描分析。
必须先输出审计计划（技术栈、范围、预计时间、模式），等待用户确认后方可执行。
</HARD-GATE>

请选择扫描模式：
1. Quick（快速扫描，约 5-10 分钟）— 高危漏洞 + 敏感信息 + 已知 CVE
2. Standard（标准扫描，约 30-60 分钟）— OWASP Top 10 + 认证授权 + 加密
3. Deep（深度扫描，约 1-3 小时）— 全维度覆盖 + 攻击链 + 业务逻辑 + 合规

# 技术栈识别
ls -la
find . -name "package.json" -o -name "pom.xml" -o -name "requirements.txt" -o -name "go.mod" | head -20
# 入口点识别
rg "router|app.route|@RequestMapping|@Controller|@RestController" -l
# 配置文件识别
find . -name "*.yml" -o -name "*.yaml" -o -name "*.properties" -o -name "*.env" | head -20
# 敏感信息预扫
rg -i "password|secret|api_key|token|private_key" -l

© ProgrammerAnthony, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 37 other files (references) in skills/code-security-audit of ProgrammerAnthony/Expert-Coding-Harness.

• SKILL.md
• README.md
• references/audit-report-template.md
• references/checklists/architecture-level-checklist.md
• references/checklists/code-level-checklist.md
• references/checklists/coverage-matrix.md
• references/compliance/compliance-frameworks.md
• references/devsecops-best-practices.md
• references/examples/audit-examples.md
• references/examples/config-file-vulnerabilities.md
• references/examples/detailed-vulnerability-chains.md
• references/examples/environment-simulation.md
• references/examples/vulnerability-analysis.md
• references/examples/vulnerability-cases.md
• references/knowledge/anti-hallucination.md
• references/knowledge/architecture-analysis.md
• … and 22 more

Open the folder on GitHubat commit ab0b827