Agent skill · security · aradotso
dfyx-code-security-audit
AI-powered code security audit skill using deep data flow analysis and business logic understanding for vulnerability detection
Why this skill is useful
Adds executable Python scripts for comprehensive security audits that leverage deep data flow analysis and specific vulnerability detection patterns.
What it needs
Requires python installed locally. About 7k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
dfyx Code Security Audit Skill Skill by ara.so — Security Skills collection. Expert-level code security auditing using white-box static analysis methodology through a five-phase standardized audit protocol. Designed by the EastSword team (东方隐侠团队) for systematic discovery and validation of security vulnerabilities in source code. What This Skill Does dfyxcodesecurityreview provides AI-powered security auditing with: Multi-language support: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust 10 security dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain Three-track audit model: Sink-driven (injection/RCE) Control-driven (authorization/business logic) Config-driven (configuration/crypto) Five-phase protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting Real-world case library: Based on WooYun vulnerability cases (2010-2016) Installation This skill doesn't require separate installation — it operates through AI agent capabilities. However, the Python helper scripts can be installed: Dependencies (requirements.txt): Core Audit Protocol Five-Phase Audit Process Audit Modes Mode Use Case Coverage Time ------ ---------- ---------- ------ Quick CI/CD, small projects Critical vulns, secrets, dependency CVEs 5-10 min Standard Regular audits OWASP Top 10, auth/authz, crypto 30-60 min Deep Critical projects, pentest prep Full coverage, attack chains, business logic 1-3 hours Usage Patterns Triggering an Audit Simply request an audit in natural language: Expected Workflow Python Helper Scripts Code Scanning Pattern Scanner Data Flow Analyzer Secret Detection Report Generator `python
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/dfyx-code-security-audit