Skylos
duriantaco/skylos
Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.
当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。
Install Source Code Audit
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaji2333/CkSKILLS source-code-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/source-code-audit .claude/skills/source-code-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .claude/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaji2333/CkSKILLS source-code-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/source-code-audit .agents/skills/source-code-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .agents/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaji2333/CkSKILLS source-code-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/source-code-audit .cursor/skills/source-code-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .cursor/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/source-code-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaji2333/CkSKILLS source-code-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/source-code-audit .gemini/skills/source-code-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .gemini/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaji2333/CkSKILLS source-code-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/source-code-audit .github/skills/source-code-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .github/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaji2333/CkSKILLS source-code-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/source-code-audit .opencode/skills/source-code-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "source-code-audit" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/source-code-audit into .opencode/skills/source-code-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "source-code-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
source-code-audit- GitHub stars
- 112
- Token cost
- ~409 tokens
- SKILL.md length
- 63 words
- Files
- 1
- Skills in repo
- 15
- Repo updated
- First seen
- Licence
- MIT
At a glance
当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。
- Security work in your project
- SKILL.md covers 何时调用（触发条件）, 一、静态审计方法（SAST）, 二、危险函数速查（按语言） and 三、鉴权审计要点, plus 2 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Source Code Audit is an agent skill from zhaji2333/CkSKILLS. 当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。
Its SKILL.md is about 410 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security. It works with Java, PHP and Python. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.
When your agent uses it
- Security work in your project
Example prompts
- “/source-code-audit”
Requirements
- Python 3
- Node.js
What it can do on your machine
Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Source Code Audit loads about 409 tokens when it runs. Until then it costs about 31 tokens; SKILL.md has 63 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 63 words, ~409 tokens.
Download SKILL.mdSave it as
.claude/skills/source-code-audit/SKILL.md (or your agent's skills folder).- name
- source-code-audit
- description
- 当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。
source-code-audit — 源码审计专项深度挖掘
何时调用（触发条件）
- 有源码（开源项目/泄露代码/反编译产物）
- 用户给代码片段要求审计
- 前端 source map 还原出完整源码
- APK 反编译后需要审计 Java/so 层
- 需要定位：拼接、反序列化、模板渲染、命令执行、文件操作、鉴权分支
一、静态审计方法（SAST）
核心思路
输入点 → 传播链 → 危险函数（Sink）审计关注
- 拼接：SQL/命令/路径/模板
- 反序列化：unserialize/readObject/pickle
- 模板渲染：用户输入进入模板引擎
- 命令执行：exec/system/ProcessBuilder
- 文件操作：上传/下载/包含/删除
- 鉴权分支：哪些接口缺少权限校验
输出格式
- 可疑调用链（输入 → 传播 → Sink）
- 关键代码片段
- 缺陷触发条件（参数、前置校验）
二、危险函数速查（按语言）
PHP
eval / assert / system / exec / passthru / shell_exec / popen
include / require / file_get_contents / unserialize
preg_replace(e修饰符) / create_function / $$变量覆盖Java
Runtime.exec / ProcessBuilder / readObject / XMLDecoder
SpEL / OGNL / MVEL / EL表达式
JNDI lookup / JdbcRowSetImpl / TemplatesImplPython
eval / exec / os.system / subprocess / pickle.loads
yaml.load(Loader=Loader) / __import__ / compileNode.js
eval / Function() / child_process / vm.runInContext
__proto__ / constructor.prototype（原型污染）Go
os/exec.Command / text/template（SSTI）
sql拼接 / 不安全的反序列化三、鉴权审计要点
- 接口/路由是否有统一鉴权中间件
- 是否存在免鉴权路径（白名单/静态资源/回调）
- 角色判断是否可信（前端传角色 vs 服务端查库）
- 对象级校验：是否只校验登录不校验归属
- 管理接口与普通接口的权限边界
四、结合其他技能
审计发现的具体漏洞类型转对应技能深化：
- 注入点 →
injection-vulns - 反序列化 →
deserialization-xxe - 文件操作 →
file-handling - 鉴权缺陷 →
auth-access-control - 加密/签名算法 →
auth-access-control
五、输出与报告要点
- 每个漏洞：输入点 / 传播链 / Sink / 缺失的校验
- 附代码片段与触发条件
- 可利用性评估（前置条件、影响面）
- 修复方案（代码级）
© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/source-code-audit of zhaji2333/CkSKILLS.
Open the folder on GitHubat commit 482fe78
Compare with similar skills
Source Code Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Source Code Audit this skillzhaji2333/CkSKILLS | 112 | — | ~409 | Automated safety check: Pass | MIT | |
| Skylosduriantaco/skylos | 843 | — | ~581 | Automated safety check: Pass | Apache-2.0 | |
| Skylos Securityduriantaco/skylos | 843 | — | ~545 | Automated safety check: Pass | Apache-2.0 | |
| SstiPentesterFlow/agent | 1.4k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | |
| Deserialization TestingNeoTheCapt/RedteamAgent | 140 | — | ~836 | Automated safety check: Pass | None | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT |
Similar skills
Skylos Security
duriantaco/skylos
Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.
Ssti
PentesterFlow/agent
Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or…
Deserialization Testing
NeoTheCapt/RedteamAgent
Insecure deserialization detection and gadget chain exploitation
- Official
Security Review
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
Hunt Deserialization
Encod3d-Sec/TORCH
Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.
More from zhaji2333/CkSKILLS
All 15 skills in this repoApk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
Business Logic Race
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
Related
Categories
Questions about Source Code Audit
What does Source Code Audit do?
当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。. Source Code Audit is an agent skill from zhaji2333/CkSKILLS.
When should I use Source Code Audit?
Source Code Audit fits situations like: security work in your project.
How do I install Source Code Audit in Claude Code?
Run `npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a claude-code`. Or copy the skill folder (.agents/skills/source-code-audit in zhaji2333/CkSKILLS) into .claude/skills/source-code-audit in your project. Claude Code loads it when a task matches its description.
How do I install Source Code Audit in Codex?
Run `npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a codex`. Or copy the skill folder (.agents/skills/source-code-audit in zhaji2333/CkSKILLS) into .agents/skills/source-code-audit in your project. Codex loads it when a task matches its description.
Can I use Source Code Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill source-code-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/source-code-audit, .gemini/skills/source-code-audit, .github/skills/source-code-audit and .opencode/skills/source-code-audit in your project.
What does Source Code Audit need to run?
SKILL.md names no scripts, command-line tools or credentials: Source Code Audit is instructions for the agent only. Our summary lists: Python 3; Node.js.
Does Source Code Audit access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Source Code Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Source Code Audit use?
Source Code Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Source Code Audit use?
About 409 tokens (SKILL.md is roughly 1.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Source Code Audit?
Skills that share tags, products or a category with Source Code Audit: Skylos (duriantaco/skylos, 843 stars), Skylos Security (duriantaco/skylos, 843 stars), Ssti (PentesterFlow/agent, 1.4k stars) and Deserialization Testing (NeoTheCapt/RedteamAgent, 140 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Source Code Audit?
zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 112 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.
Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.