Skip to main content
affpapa.org
RU EN
skill CX Codex

dfyx-code-security-auditor — Claude Code skill: security audit

A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a claude-code
Open on GitHub

What dfyx-code-security-auditor does

dfyx-code-security-auditor reviews Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust code. Its checks cover 10 areas, including injection, authentication, authorization, deserialization, file handling, SSRF, cryptography, configuration, business logic, and dependencies.

The audit moves through five stages: map the project, locate risky patterns, follow data from inputs to sinks, validate attack paths, and produce a remediation report. Quick, standard, and deep modes change the review scope, from critical flaws and dependency CVEs to full coverage with business-logic chains.

Helper scripts rely on packages from requirements.txt, installed with pip install -r requirements.txt. Those scripts will not run without the listed dependencies.

What it helps with

  • find SQL, command, and LDAP injection paths
  • check authorization controls and IDOR exposure
  • trace untrusted data into dangerous sinks
  • inspect deserialization and file handling
  • scan dependencies for CVEs

Example prompts for the agent

  • Run a deep security audit of this project and map any attack chains.
  • Review this application for injection, authorization gaps, and unsafe deserialization.
  • Check the code against OWASP risks and write a remediation report.

How to install dfyx-code-security-auditor

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a claude-code

2Manually: put the files in place

~/.claude/skills/dfyx-code-security-auditor/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/dfyx-code-security-auditor/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about dfyx-code-security-auditor

How do I install dfyx-code-security-auditor in Claude Code?

Run npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a claude-code, then use the skill at ~/.claude/skills/dfyx-code-security-auditor/SKILL.md.

What does dfyx-code-security-auditor do?

It performs white-box static analysis, follows data flows, and reviews 10 security dimensions. The result includes findings, attack chains, and suggested fixes.

Which languages does the skill support?

It covers Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set42

esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs foundry-security-spec A skill that walks your agent through implementing Cisco's Foundry spec: a multi-role system for finding and validating vulnerabilities. Useful when you're building your own evaluation pipeline. CX Codex +1 683installs web-security-scanner-pro A skill that teaches your agent to drive Web Security Scanner Pro: 49 modules, WAF evasion, CMS checks and HTML or PDF reports. CX Codex +1 607installs pentestcompanion-workspace This skill wires your agent into a self-hosted Pentest Companion workspace for running engagements, tools and reports. CX Codex +1 534installs agentic-security-scanner A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it. CX Codex +1 462installs security-investigator-automation A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request. CX Codex +1 322installs linux-pentester-commands A Linux command reference for reconnaissance, enumeration, exploitation, and privilege escalation during authorized penetration testing. CX Codex +1 319installs linux-pentester-command-reference A skill that hands your agent a Linux command reference split by pentest phase: recon, enumeration, exploitation, privesc. CX Codex +1 308installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor