Agent skill · security · aradotso
dfyx-code-security-auditor
Deep code security audit skill using white-box static analysis with 5-phase protocol covering 10 security dimensions across 9 languages
Why this skill is useful
Adds a comprehensive 5-phase security auditing protocol with multi-language support and specific vulnerability detection methodologies that the AI cannot generate on its own.
What it needs
Requires git, python installed locally. About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
dfyx-code-security-auditor Skill by ara.so — Security Skills collection. Expert-level code security auditing based on deep data flow analysis and business logic understanding. Implements a standardized 5-phase white-box static analysis methodology to systematically discover and validate security vulnerabilities in source code. What This Skill Does dfyxcodesecurityreview provides systematic code security auditing through: Multi-language support: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust 10 security dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain 3-track audit model: Sink-driven (injections), Control-driven (authorization/logic), Config-driven (configurations) 5-phase protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting Real-world case library: Based on WooYun vulnerability cases (2010-2016) Installation This skill is designed to be used within AI coding agents that support custom skills. For Claude Code: For Cursor/Windsurf: Python Dependencies (for helper scripts): Core Methodology 5-Phase Audit Protocol 10 Security Dimensions Dimension Coverage Method ----------- ---------- -------- D1: Injection SQL, Command, LDAP, SSTI, SpEL, JNDI Sink-driven: Find dangerous functions → trace input D2: Authentication Token, Session, JWT, Filter chains Config-driven: Check implementation completeness D3: Authorization CRUD permissions, IDOR, horizontal privilege escalation Control-driven: Verify controls exist D4: Deserialization Java/Python/PHP gadget chains Sink-driven: Find unserialize() → trace input D5: File Operations Upload, download, path traversal Sink-driven: Find file ops → validate sanitization D6: SSRF URL injection, protocol restrictions Sink-driven: Find HTTP clients → trace URLs D7: Cryptography Key management, cipher modes, KDF Config-driven: Check crypto implementations D8: Configuration Debug endpoin …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/dfyx-code-security-auditor