/code-audit

name: code-audit
description: |
  Professional code security audit skill covering 55+ vulnerability types.
  Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016).
  This skill should be used when performing security audits, vulnerability scanning,
  penetration testing preparation, or code review for security issues.
  Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust.
  Includes 143 mandatory detection items across all languages with language-specific checklists.
  Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection,
  authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android).
  WooYun integration adds: statistical-driven parameter priority, bypass techniques library,
  logic vulnerability patterns, and real-case references.
  v1.0: Initial public release with Docker deployment verification framework.
tools:
  - Read
  - Grep
  - Glob
  - Bash
  - Task
  - LSP
model: sonnet
priority: high
file_patterns:
  - "**/*.java"
  - "**/*.py"
  - "**/*.go"
  - "**/*.php"
  - "**/*.js"
  - "**/*.ts"
  - "**/*.jsx"
  - "**/*.tsx"
  - "**/*.c"
  - "**/*.cpp"
  - "**/*.h"
  - "**/*.cs"
  - "**/*.rb"
  - "**/*.rs"
  - "**/*.xml"
  - "**/*.yml"
  - "**/*.yaml"
  - "**/*.json"
  - "**/*.properties"
  - "**/Dockerfile"
  - "**/*.tf"
exclude_patterns:
  - "**/node_references/**"
  - "**/vendor/**"
  - "**/dist/**"
  - "**/build/**"
  - "**/.git/**"
  - "**/test/**"
  - "**/tests/**"
  - "**/__pycache__/**"

Code Audit Skill

> 专业代码安全审计技能 | Professional Code Security Audit > 支持模式: quick / standard / deep

When to Use This Skill

This skill should be used when:

• User requests **code audit**, **security audit**, or **vulnerability scanning**
• User asks to **check code security** or **find security issues**
• User mentions **/audit** or **/code-audit**
• User wants to **review code for vulnerabilities** before deployment
• User needs **penetration testing preparation** or **security assessment**

**Trigger phrases:**

• "审计这个项目" / "Audit this project"
• "检查代码安全" / "Check code security"
• "找出安全漏洞" / "Find security vulnerabilities"
• "/audit", "/code-audit"

---

Quick Reference

Scan Modes

| Mode | Use Case | Scope | |------|----------|-------| | **Quick** | CI/CD, small projects | High-risk vulns, secrets, dependency CVEs | | **Standard** | Regular audits | OWASP Top 10, auth, crypto | | **Deep** | Critical projects, pentests | Full coverage, attack chains, business logic |

Core Workflow

1. Reconnaissance   → Identify tech stack, map attack surface
2. Vulnerability Hunt → Search patterns, trace data flow
3. Verification    → Confirm exploitability, filter false positives
4. Docker Verify   → [NEW] Dynamic verification in sandbox (optional)
5. Report          → Document findings with PoC and fixes

Docker部署验证

对于深度审计，可使用Docker沙箱进行**动态验证**:

# 生成验证环境
code-audit --generate-docker-env

# 启动并验证
docker-compose up -d
docker exec -it sandbox python /workspace/poc/verify_all.py

详见: `references/core/docker_verification.md`

---

Execution Controller（执行控制器 — 必经路径）

> ⚠️ 以下步骤是审计执行的必经路径，不是参考建议。 > 每步有必须产出的输出，后续步骤依赖前序输出。不产出 = 用户可见缺失。

Step 1: 模式判定

根据用户指令确定审计模式：

| 用户指令关键词 | 模式 | |--------------|------| | "快速扫描" "quick" "CI检查" | quick | | "审计" "扫描" "安全检查"（无特殊说明） | standard | | "深度审计" "deep" "渗透测试准备" "全面审计" | deep | | 无法判定 | **问用户，不得自行假设** |

**反降级规则**: 用户指定的模式不可自行降级。项目规模大不是降级理由，而是启用 Multi-Agent 的理由。降级需用户明确确认。

**必须输出**:

[MODE] {quick|standard|deep}

Step 2: 文档加载

按模式加载必要文档（用 Read 工具实际读取，不是"知道有这个文件"）：

| 模式 | 必须 Read 的文档 | |------|-----------------| | quick | 当前 SKILL.md 已加载，无需额外文档 | | standard | + `references/checklists/coverage_matrix.md` + 对应语言 checklist | | deep | + **`agent.md`（完整读取，不可跳过）** + `coverage_matrix.md` + 对应语言 checklist |

deep 模式下 agent.md 是必读文档 — Step 4 的执行计划模板包含只有 agent.md 中才有的字段（维度权重、Agent 切分模板、门控条件、执行状态机）。

**必须输出**:

[LOADED] {实际 Read 的文档列表，含行数}

Step 3: 侦察（Reconnaissance）

对目标项目执行攻击面测绘。

**必须输出**:

[RECON]
项目规模: {X files, Y directories}
技术栈: {language, framework, version}
项目类型: {CMS | 金融 | SaaS | 数据平台 | 身份认证 | IoT | 通用Web}
入口点: {Controller/Router/Handler 数量}
关键模块: {列表}

Step 4: 执行计划 → STOP

基于 Step 1-3 的输出生成执行计划。**输出后暂停，等待用户确认才能继续。**

**quick/standard 模板**:

[PLAN]
模式: {mode}
技术栈: {from Step 3}
扫描维度: {计划覆盖的 D1-D10 维度}
已加载文档: {from Step 2}

**deep 模板**（全部字段必填 — 标注了信息来源文档）:

[PLAN]
模式: deep
项目规模: {from Step 3}
技术栈: {from Step 3}
维度权重: {from agent.md 状态机 → 项目类型维度权重，如 CMS: D5(++), D1(+), D3(+), D6(+)}
Agent 方案: {from agent.md Agent 模板 → 每个 Agent 负责的维度和 max_turns}
Agent 数量: {from agent.md 规模建议 → 小型(<10K) 2-3, 中型(10K-100K) 3-5, 大型(>100K) 5-9}
D9 覆盖策略: {若项目有后台管理/多角色/多租户 → D9 必查，D3 Agent 须同时覆盖 D9a(IDOR+权限一致性+Mass Assignment)}
轮次规划: R1 广度扫描 → R1 评估 → R2 增量补漏(按需)
门控条件: PHASE_1_RECON → ROUND_N_RUNNING → ROUND_N_EVALUATION → REPORT
预估总 turns: {Agent数 × max_turns}
已加载文档: {from Step 2}

**⚠️ STOP — 输出执行计划后暂停。等待用户确认后才能开始审计。**

Step 5: 执行

用户确认后，按执行计划和已加载文档执行：

• **quick**: 高危模式匹配扫描，直接输出
• **standard**: 按 Phase 1→5 顺序执行
• **deep**: 严格按 agent.md 执行状态机
• 启动 Multi-Agent 并行（按 Step 4 确认的 Agent 方案）
• 遵守每个 State 的门控条件
• 轮次评估使用 agent.md 三问法则

Step 6: 报告门控

生成报告前验证：

| 前置条件 | quick | standard | deep | |---------|-------|----------|------| | 高危模式扫描完成 | ✅ | ✅ | ✅ | | D1-D10 覆盖率标记（✅已覆盖/⚠️浅覆盖/❌未覆盖） | — | ✅ | ✅ | | 所有 Agent 完成或超时标注 | — | — | ✅ | | 轮次评估三问通过 | — | — | ✅ |

不满足前置条件 → 不得生成最终报告。

---

Anti-Hallucination Rules (MUST FOLLOW)

⚠️ Every finding MUST be based on actual code read via tools

✗ Do NOT guess file paths based on "typical project structure"
✗ Do NOT fabricate code snippets from memory
✗ Do NOT report vulnerabilities in files you haven't read

✓ MUST use Read/Glob to verify file exists before reporting
✓ MUST quote actual code from Read tool output
✓ MUST match project's actual tech stack

**Core principle: Better to miss a v