Skip to content
Get packs

Source Code Security Audit

Guides an agent through authorized source-code security reviews using SAST tools and manual verification.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

Once installed, the agent follows a structured workflow for reviewing a codebase for security flaws: it sets a threat model, runs static analysis scanners such as Semgrep, CodeQL, Bandit, gosec or SpotBugs, then manually checks each hit for reachability, exploitability and false positives. It reports findings with location, data flow, a proof of concept and a fix suggestion. The skill asks for written authorization and a defined scope before starting.

Great for

  • Security engineers doing authorized white-box reviews of their own or client code
  • Developers wanting a checklist-driven review of a pull request or service for injection, auth and crypto mistakes
  • Students learning how SAST findings are triaged and verified

Skip it if

  • Reviewing code you do not have permission to test, since the skill is built around offensive-style proof-of-concept work
  • Dependency or supply-chain vulnerability scanning, which the skill itself routes to a separate skill
  • Analysing compiled binaries without source, which the skill says should go to a reverse-engineering skill instead

Try asking

  • “Run a security review of the payments service in this repo, focusing on auth and injection points”
  • “Review the diff in this pull request for IDOR and missing authorization checks”
  • “Triage these Semgrep results and tell me which are real findings and which are false positives”
  • “Write a finding report with data flow, PoC and fix suggestions for the hardcoded key you found”
Step-by-step guide: how to use Source Code Security AuditInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    code-audit.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip code-audit.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip code-audit.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State the language stack and exact scope (directory, service or PR diff) before the agent starts scanning
  • Ask the agent to justify each finding manually rather than pasting raw scanner output
  • Confirm authorization in writing first; the skill's checklist expects you to stay within the authorized repository

What's inside

  • references/sast-review-checklist.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.