create-rule
Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up project…
@coco-researchInstall SkillDevelopment
Skill
/code-audit
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
Claude Code
$ npx -y skills add coco-research/coco --skill code-audit --agent claude-code
Codex
$ npx skills add coco-research/coco --skill code-audit -a codex -y
Cursor
$ npx skills add coco-research/coco --skill code-audit -a cursor -y
Gemini CLI
$ npx skills add coco-research/coco --skill code-audit -a gemini-cli -y
GitHub Copilot
$ npx skills add coco-research/coco --skill code-audit -a github-copilot -y
OpenCode
$ npx skills add coco-research/coco --skill code-audit -a opencode -y
Windsurf
$ npx skills add coco-research/coco --skill code-audit -a windsurf -y
SKILL.md
code-audit.SKILL.mdname: code-audit description: Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification. user-invocable: true
Source Code Security Audit
适用场景
- 白盒审计、PR/差分安全审查
- Semgrep / CodeQL / Bandit / gosec 等 SAST
- 危险 API、注入点、鉴权缺失、加密误用
- 与 `supply-chain-security/` 分工：本 skill 偏**自有代码逻辑**，供应链偏依赖与管道
工作流
1. 范围与威胁模型
□ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件 □ 高价值资产：鉴权、支付、管理端、密钥处理
2. 自动扫描
semgrep --config auto . # 或项目规则包 semgrep --config p/owasp-top-ten .
3. 人工验证（MUST）
□ 每个 SAST 命中：可达性？可利用性？误报？ □ 鉴权：IDOR/越权、缺校验、错误的多租户隔离 □ 注入：SQL/命令/模板/LDAP □ 加密：硬编码密钥、ECB、自定义 crypto
4. 产出
Finding：位置 + 数据流 + PoC + 修复建议 可选 ATT&CK / CWE 编号
工具链
| 工具 | 语言/场景 | |------|-----------| | Semgrep | 多语言快速规则 | | CodeQL | 深数据流（GitHub） | | Bandit | Python | | gosec / staticcheck | Go | | SpotBugs / FindSecBugs | Java |
参考
- `references/sast-review-checklist.md`
- `../supply-chain-security/` `../api-security/` `../llm-security/`（Agent 代码）
Ships withcoco
495 personas across 13 departments, 229 skills[^installed] and 388 commands in the full catalog (coco 1.9.0, 2026-10-21). Agent skills, slash commands and subagents for Claude Code, Cursor, Codex and other AI coding agents.
631200 skills53 agents
Stars on GitHub
Momentum
- stars in total
- 631
Other skills on coco.
@coco-researchInstall Skillcreate-skill
Guides users through creating effective Agent Skills for Cursor. Use when the user wants to create, write, or author a new skill,…
@coco-researchInstall Skillcreate-subagent
Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific…
@coco-researchInstall Skillmigrate-to-skills
Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills…
@coco-researchInstall Skillupdate-cursor-settings
Modify Cursor/VSCode user settings in settings.json. Use when the user wants to change editor settings, preferences,…
@coco-researchInstall Skillagent-lightning
Train and optimize AI agents using Microsoft's Agent Lightning framework with reinforcement learning. Use when setting up agent…
@coco-researchInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about code-audit.
- Which coding agents can use code-audit?
- code-audit installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.