Agent skill · security · aradotso
dfyx-code-security-review
Expert-level code security audit skill using deep data flow analysis and business logic understanding for white-box static analysis across 9 languages
Why this skill is useful
Adds a comprehensive five-phase security audit protocol and dual-track analysis methodology that significantly enhances the AI's ability to identify and validate security vulnerabilities in code.
What it needs
Requires git, python installed locally. About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
dfyx-code-security-review Skill by ara.so — Security Skills collection. A professional code security audit skill designed for AI coding agents, implementing a five-phase standardized audit protocol with dual-track analysis (Sink-driven, Control-driven, Config-driven) to systematically discover and validate security vulnerabilities in source code. Overview dfyxcodesecurityreview provides expert-level white-box static analysis capabilities covering: 9 Languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust 10 Security Dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain 14 Frameworks: Spring Boot, Django, Flask, FastAPI, Express, Koa, Gin, Laravel, Rails, ASP.NET Core, Rust Web, NestJS/Fastify, MyBatis, ProcessWire Installation Clone the repository and integrate with your AI coding agent: Core Methodology Five-Phase Audit Protocol Dual-Track Audit Model Track Dimensions Method Target ------- ----------- -------- -------- Sink-driven D1 Injection, D4 Deserialization, D5 File Ops, D6 SSRF Grep dangerous functions → Trace data flow → Verify no protection Existing dangerous code Control-driven D3 Authorization, D9 Business Logic Enumerate endpoints → Verify security controls exist → Missing = Vulnerability Missing security controls Config-driven D2 Authentication, D7 Crypto, D8 Config, D10 Supply Chain Search configs → Compare security baseline Misconfigurations Security Dimensions # Dimension Coverage --- ----------- ---------- D1 Injection SQL/Command/LDAP/SSTI/SpEL/JNDI/XPath/XML injection D2 Authentication Token/Session/JWT/Filter chain vulnerabilities D3 Authorization CRUD consistency, IDOR, horizontal privilege escalation D4 Deserialization Java/Python/PHP gadget chains, unsafe deserialization D5 File Operations Upload/download/path traversal vulnerabilities D6 SSRF URL injection, protocol bypass D7 Cryptography Key management, weak algorithms, …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/dfyx-code-security-review