dfyx-code-security-review — Claude Code skill: audit
This skill performs white-box static analysis of code, tracing data flows and checking security controls, configuration, and business logic. Use it for a deep project audit.
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a claude-codeWhat dfyx-code-security-review does
The skill follows a five-stage review process. It maps the stack and attack surface, searches for dangerous sinks and missing controls, traces data through code, validates possible attack paths, then produces findings with remediation guidance. Its analysis uses sink-driven, control-driven, and configuration-driven passes.
Checks cover injection, authentication, authorization, unsafe deserialization, file handling, SSRF, cryptography, configuration, business logic, and supply-chain issues. The listed language coverage includes Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust; framework coverage includes Spring Boot, Django, Flask, FastAPI, Express, and others named in the description. Standalone scripts use Python dependencies from requirements.txt.
What it helps with
- audit a codebase for OWASP vulnerabilities
- trace input into SQL or command injection sinks
- find missing authorization checks
- inspect insecure configuration and dependencies
- prioritize findings and remediation work
Example prompts for the agent
- Run a deep security audit of this codebase and trace practical attack paths.
- Check this project for injection, authentication, and authorization flaws.
- Review the dependencies and configuration against OWASP Top 10 risks.
How to install dfyx-code-security-review
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a claude-code2Manually: put the files in place
~/.claude/skills/dfyx-code-security-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/dfyx-code-security-review/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a codex2Manually: put the files in place
.agents/skills/dfyx-code-security-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a cursor2Manually: put the files in place
.cursor/skills/dfyx-code-security-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills dfyx-code-security-review2Manually: put the files in place
.github/skills/dfyx-code-security-review/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/dfyx-code-security-reviewManually: put the files in place
.devin/skills/dfyx-code-security-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about dfyx-code-security-review
How do I install dfyx-code-security-review in Claude Code?
Run npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a claude-code, then use the skill at ~/.claude/skills/dfyx-code-security-review/SKILL.md.
What does dfyx-code-security-review do?
It performs white-box static analysis by tracing data flows, checking security controls and configuration, validating vulnerabilities, and writing remediation guidance.
Which languages does the skill cover?
The listed coverage includes Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust.
