Code Audit Skill

专业代码安全审计技能 | Professional Code Security Audit 支持模式: quick / standard / deep

When to Use This Skill

This skill should be used when:

• User requests code audit, security audit, or vulnerability scanning

• User asks to check code security or find security issues

• User mentions /audit or /code-audit

• User wants to review code for vulnerabilities before deployment

• User needs penetration testing preparation or security assessment

Trigger phrases:

• "审计这个项目" / "Audit this project"

• "检查代码安全" / "Check code security"

• "找出安全漏洞" / "Find security vulnerabilities"

• "/audit", "/code-audit"

Quick Reference

Scan Modes

Mode Use Case Scope

Quick CI/CD, small projects High-risk vulns, secrets, dependency CVEs

Standard Regular audits OWASP Top 10, auth, crypto

Deep Critical projects, pentests Full coverage, attack chains, business logic

Core Workflow

1. Reconnaissance → Identify tech stack, map attack surface
2. Vulnerability Hunt → Search patterns, trace data flow
3. Verification → Confirm exploitability, filter false positives
4. Docker Verify → [NEW] Dynamic verification in sandbox (optional)
5. Report → Document findings with PoC and fixes

Docker部署验证

对于深度审计，可使用Docker沙箱进行动态验证:

生成验证环境

code-audit --generate-docker-env

启动并验证

docker-compose up -d docker exec -it sandbox python /workspace/poc/verify_all.py

详见: references/core/docker_verification.md

Execution Controller（执行控制器 — 必经路径）

⚠️ 以下步骤是审计执行的必经路径，不是参考建议。 每步有必须产出的输出，后续步骤依赖前序输出。不产出 = 用户可见缺失。

Step 1: 模式判定

根据用户指令确定审计模式：

用户指令关键词 模式

"快速扫描" "quick" "CI检查" quick

"审计" "扫描" "安全检查"（无特殊说明） standard

"深度审计" "deep" "渗透测试准备" "全面审计" deep

无法判定 问用户，不得自行假设

反降级规则: 用户指定的模式不可自行降级。项目规模大不是降级理由，而是启用 Multi-Agent 的理由。降级需用户明确确认。

必须输出:

[MODE] {quick|standard|deep}

Step 2: 文档加载

按模式加载必要文档（用 Read 工具实际读取，不是"知道有这个文件"）：

模式 必须 Read 的文档

quick 当前 SKILL.md 已加载，无需额外文档

standard

• references/checklists/coverage_matrix.md
• 对应语言 checklist

deep

• agent.md （完整读取，不可跳过） + coverage_matrix.md
• 对应语言 checklist

deep 模式下 agent.md 是必读文档 — Step 4 的执行计划模板包含只有 agent.md 中才有的字段（维度权重、Agent 切分模板、门控条件、执行状态机）。

必须输出:

[LOADED] {实际 Read 的文档列表，含行数}

Step 3: 侦察（Reconnaissance）

对目标项目执行攻击面测绘。

必须输出:

[RECON] 项目规模: {X files, Y directories} 技术栈: {language, framework, version} 项目类型: {CMS | 金融 | SaaS | 数据平台 | 身份认证 | IoT | 通用Web} 入口点: {Controller/Router/Handler 数量} 关键模块: {列表}

Step 4: 执行计划 → STOP

基于 Step 1-3 的输出生成执行计划。输出后暂停，等待用户确认才能继续。

quick/standard 模板:

[PLAN] 模式: {mode} 技术栈: {from Step 3} 扫描维度: {计划覆盖的 D1-D10 维度} 已加载文档: {from Step 2}

deep 模板（全部字段必填 — 标注了信息来源文档）:

[PLAN] 模式: deep 项目规模: {from Step 3} 技术栈: {from Step 3} 维度权重: {from agent.md 状态机 → 项目类型维度权重，如 CMS: D5(++), D1(+), D3(+), D6(+)} Agent 方案: {from agent.md Agent 模板 → 每个 Agent 负责的维度和 max_turns} Agent 数量: {from agent.md 规模建议 → 小型(<10K) 2-3, 中型(10K-100K) 3-5, 大型(>100K) 5-9} D9 覆盖策略: {若项目有后台管理/多角色/多租户 → D9 必查，D3 Agent 须同时覆盖 D9a(IDOR+权限一致性+Mass Assignment)} 轮次规划: R1 广度扫描 → R1 评估 → R2 增量补漏(按需) 门控条件: PHASE_1_RECON → ROUND_N_RUNNING → ROUND_N_EVALUATION → REPORT 预估总 turns: {Agent数 × max_turns} 已加载文档: {from Step 2}

⚠️ STOP — 输出执行计划后暂停。等待用户确认后才能开始审计。

Step 5: 执行

用户确认后，按执行计划和已加载文档执行：

• quick: 高危模式匹配扫描，直接输出

• standard: 按 Phase 1→5 顺序执行

• deep: 严格按 agent.md 执行状态机

• 启动 Multi-Agent 并行（按 Step 4 确认的 Agent 方案）

• 遵守每个 State 的门控条件

• 轮次评估使用 agent.md 三问法则

Step 6: 报告门控

生成报告前验证：

前置条件 quick standard deep

高危模式扫描完成 ✅ ✅ ✅

D1-D10 覆盖率标记（✅已覆盖/⚠️浅覆盖/❌未覆盖） — ✅ ✅

所有 Agent 完成或超时标注 — — ✅

轮次评估三问通过 — — ✅

不满足前置条件 → 不得生成最终报告。

Anti-Hallucination Rules (MUST FOLLOW)

⚠️ Every finding MUST be based on actual code read via tools

✗ Do NOT guess file paths based on "typical project structure" ✗ Do NOT fabricate code snippets from memory ✗ Do NOT report vulnerabilities in files you haven't read

✓ MUST use Read/Glob to verify file exists before reporting ✓ MUST quote actual code from Read tool output ✓ MUST match project's actual tech stack

Core principle: Better to miss a vulnerability than report a false positive.

Anti-Confirmation-Bias Rules (MUST FOLLOW)

⚠️ Audit MUST be methodology-driven, NOT case-driven

✗ Do NOT say "基于之前的审计经验，我将重点关注..." ✗ Do NOT prioritize certain vuln types based on "known CVEs" ✗ Do NOT skip checklist items because they seem "less likely"

✓ MUST enumerate ALL sensitive operations, then verify EACH one ✓ MUST complete the full checklist for EACH vulnerability type ✓ MUST treat all potential vulnerabilities with equal rigor

Core principle: Discover ALL potential vulnerabilities, not just familiar patterns.

Two-Layer Checklist (两层检查清单)

Layer 1: coverage_matrix.md — Phase 2A后加载，验证10个安全维度覆盖率 Layer 2: 语言语义提示 — 仅对未覆盖维度按需加载对应段落

文件 用途

references/checklists/coverage_matrix.md

覆盖率矩阵 (D1-D10)

references/checklists/universal.md

通用架构/逻辑级语义提示

references/checklists/java.md

Java 语义提示 (10维度)

references/checklists/python.md

Python 语义提示

references/checklists/php.md

PHP 语义提示

references/checklists/javascript.md

JavaScript/Node.js 语义提示

references/checklists/go.md

Go 语义提示

references/checklists/dotnet.md

.NET/C# 语义提示

references/checklists/ruby.md

Ruby 语义提示

references/checklists/c_cpp.md

C/C++ 语义提示

references/checklists/rust.md

Rust 语义提示

核心原则: Checklist 不驱动审计，而是验证覆盖。LLM 先自由审计(Phase 2A)，再用矩阵查漏(Phase 2B)。

Module Reference

Core Modules (Load First)

Module Path Purpose

Capability Baseline references/core/capability_baseline.md

防止能力丢失的回归测试框架

Anti-Hallucination references/core/anti_hallucination.md

Prevent false positives

Audit Methodology references/core/comprehensive_audit_methodology.md

Systematic framework, coverage tracking

Taint Analysis references/core/taint_analysis.md

Data flow tracking, LSP-enhanced tracking, Slot type classification

PoC Generation references/core/poc_generation.md

Verification templates

External Tools references/core/external_tools_guide.md

Semgrep/Bandit integration

Language Modules (Load by Tech Stack)

Language Module Key Vulnerabilities

Java references/languages/java.md

SQL injection, XXE, deserialization

Python references/languages/python.md

Pickle, SSTI, command injection

Go references/languages/go.md

Race conditions, SSRF

PHP references/languages/php.md

File inclusion, deserialization

JavaScript references/languages/javascript.md

Prototype pollution, XSS

Security Domain Modules (Load as Needed)

Domain Module When to Load

API Security references/security/api_security.md

REST/GraphQL APIs

LLM Security references/security/llm_security.md

AI/ML applications

Serverless references/security/serverless.md

AWS Lambda, Azure Functions

Cryptography references/security/cryptography.md

Encryption, TLS, JWT

Race Conditions references/security/race_conditions.md

Concurrent operations

Tool Priority Strategy

Priority 1: External Professional Tools (if available) ├─ semgrep scan --config auto # Multi-language SAST ├─ bandit -r ./src # Python security ├─ gosec ./... # Go security └─ gitleaks detect # Secret scanning

Priority 2: Built-in Analysis (always available) ├─ LSP semantic analysis # goToDefinition, findReferences, incomingCalls ├─ Read + Grep pattern matching # Core analysis └─ Module knowledge base # 55+ vuln patterns

Priority 3: Verification ├─ PoC templates from references/core/poc_generation.md └─ Confidence scoring from references/core/verification_methodology.md

Detailed Documentation

For complete audit methodology, vulnerability patterns, and detection rules, see:

• Full Workflow: agent.md

• Complete audit process and detection commands

• Vulnerability Details: references/

• Language/framework-specific patterns

• Tool Integration: references/core/external_tools_guide.md

• Report Templates: references/core/taint_analysis.md

Version

• Current: 1.0

• Updated: 2026-02-13

v1.0 (Initial Public Release)

• 9语言143项强制检测清单 (references/checklists/ )

• 双轨并行审计框架: Sink-driven + Control-driven + Config-driven

• Docker部署验证框架 (references/core/docker_verification.md )

• WooYun 88,636案例库集成

• 安全控制矩阵框架