Agent skill · security · aradotso
eastsword-dfyx-code-security-review
Expert-level code security audit skill using deep data flow analysis, taint tracking, and business logic understanding across 9 languages
Why this skill is useful
Adds a comprehensive five-phase security audit protocol with executable scripts for deep data flow analysis and vulnerability detection across multiple languages.
What it needs
Requires git, python installed locally. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
EastSword DFYX Code Security Review Skill by ara.so — Security Skills collection. Expert-level code security audit skill developed by the EastSword (东方隐侠) team. Performs comprehensive white-box static analysis using a five-phase standardized audit protocol with deep data flow analysis, taint tracking, and business logic understanding. Overview dfyxcodesecurityreview is a professional code security audit skill designed for AI coding agents. It employs white-box static analysis methodology through a five-phase standardized protocol to systematically discover and validate security vulnerabilities in source code. Core Capabilities 9 Languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust 14 Frameworks: Spring Boot, Django, Flask, FastAPI, Express, Koa, Gin, Laravel, Rails, ASP.NET Core, Rust Web, NestJS, Fastify, MyBatis 10 Security Dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain Triple-Track Audit Model: Sink-driven + Control-driven + Config-driven Five-Phase Protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting Rich Case Library: Based on real-world WooYun vulnerability cases (2010-2016) Installation Clone or copy this skill to your AI client's skills directory: Five-Phase Audit Protocol Phase 1: Reconnaissance & Mapping (10%) Objective: Understand architecture and identify attack surface. Key Activities: Identify entry points (REST endpoints, file uploads, external integrations) Map data flows from sources to sinks Enumerate security controls and their coverage Build architectural diagram with trust boundaries Phase 2: Parallel Pattern Matching (30%) Objective: Identify high-risk code patterns across all dimensions. Detection Rules: Phase 3: Deep Taint Tracking & Validation (40%) Objective: Trace data flows from sources to sinks and validate exploitability. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/eastsword-dfyx-code-security-review