dfyx-code-security-audit — Claude Code skill: audit and install
This skill audits source code for vulnerabilities through data-flow analysis and business-logic review. Use it for a project security check or pentest preparation.
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a claude-codeWhat dfyx-code-security-audit does
dfyx-code-security-audit follows a five-phase audit flow: reconnaissance, pattern matching, taint tracking, validation, and reporting. It examines ten security areas, including injection, authentication, authorization, SSRF, cryptography, configuration, and business logic. The skill offers quick, standard, and deep audit modes.
The audit covers Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust. The repository also includes Python helpers for scanning code patterns and tracing data flows. Python plus the packages in requirements.txt are needed when those helper scripts are used.
The skill itself runs through the agent, while the optional helper scripts can be installed separately. In Claude Code, add it with npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a claude-code; the installed skill file is at ~/.claude/skills/dfyx-code-security-audit/SKILL.md.
What it helps with
- find injection and command-execution risks
- review authorization paths and business-logic flaws
- trace user-controlled data into dangerous sinks
- produce a structured vulnerability report
- inspect project configuration and dependencies
Example prompts for the agent
- Run a deep security audit of this project and map any attack chains.
- Check the code for SQL injection, authorization flaws, and unsafe deserialization.
- Scan this project in
quickmode and report the vulnerabilities you find.
How to install dfyx-code-security-audit
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a claude-code2Manually: put the files in place
~/.claude/skills/dfyx-code-security-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/dfyx-code-security-audit/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a codex2Manually: put the files in place
.agents/skills/dfyx-code-security-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a cursor2Manually: put the files in place
.cursor/skills/dfyx-code-security-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills dfyx-code-security-audit2Manually: put the files in place
.github/skills/dfyx-code-security-audit/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/dfyx-code-security-auditManually: put the files in place
.devin/skills/dfyx-code-security-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about dfyx-code-security-audit
How do I install dfyx-code-security-audit in Claude Code?
Run npx skills add reason-machines/security-skills --skill dfyx-code-security-audit -a claude-code. The skill file will be available at ~/.claude/skills/dfyx-code-security-audit/SKILL.md.
What does dfyx-code-security-audit do?
It audits source code for vulnerabilities by combining pattern searches, data-flow tracing, and business-logic review. The workflow ends with a structured audit report.
Which languages does dfyx-code-security-audit support?
It supports Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust.
