# dfyx-code-security-auditor

A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 334 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/dfyx-code-security-auditor/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/dfyx-code-security-auditor

## What it does

dfyx-code-security-auditor reviews Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust code. Its checks cover 10 areas, including injection, authentication, authorization, deserialization, file handling, SSRF, cryptography, configuration, business logic, and dependencies.

The audit moves through five stages: map the project, locate risky patterns, follow data from inputs to sinks, validate attack paths, and produce a remediation report. Quick, standard, and deep modes change the review scope, from critical flaws and dependency CVEs to full coverage with business-logic chains.

Helper scripts rely on packages from `requirements.txt`, installed with `pip install -r requirements.txt`. Those scripts will not run without the listed dependencies.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/dfyx-code-security-auditor/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/dfyx-code-security-auditor/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/dfyx-code-security-auditor/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/dfyx-code-security-auditor/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills dfyx-code-security-auditor
```

2. **Manually: put the files in place**
- File: `.github/skills/dfyx-code-security-auditor/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/dfyx-code-security-auditor
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/dfyx-code-security-auditor/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-auditor -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/dfyx-code-security-auditor/SKILL.md

## When to use it
- find SQL, command, and LDAP injection paths
- check authorization controls and IDOR exposure
- trace untrusted data into dangerous sinks
- inspect deserialization and file handling
- scan dependencies for CVEs

## Example prompts
- Run a deep security audit of this project and map any attack chains.
- Review this application for injection, authorization gaps, and unsafe deserialization.
- Check the code against OWASP risks and write a remediation report.

## Similar
- [security-auditor](https://affpapa.org/en/nevibecode/skills/sickn33-security-auditor.md) — skill · 1400 installs
- [security-scan](https://affpapa.org/en/nevibecode/skills/codewithmukesh-security-scan.md) — skill · 2800 installs
- [Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened)](https://affpapa.org/en/nevibecode/prompts/python-security-vulnerability-auditor-owasp-mapped-production-hardened.md) — prompt · ★ 174676
- [code-review-pro](https://affpapa.org/en/nevibecode/skills/code-review-pro.md) — skill · 2600 installs
- [security-review](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — skill · 21300 installs
- [comprehensive-review-security-auditor](https://affpapa.org/en/nevibecode/agents/comprehensive-review-security-auditor.md) — subagent · ★ 41823

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md