# dfyx-code-security-review

This skill performs white-box static analysis of code, tracing data flows and checking security controls, configuration, and business logic. Use it for a deep project audit.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 338 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/dfyx-code-security-review/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/dfyx-code-security-review

## What it does

The skill follows a five-stage review process. It maps the stack and attack surface, searches for dangerous sinks and missing controls, traces data through code, validates possible attack paths, then produces findings with remediation guidance. Its analysis uses sink-driven, control-driven, and configuration-driven passes.

Checks cover injection, authentication, authorization, unsafe deserialization, file handling, SSRF, cryptography, configuration, business logic, and supply-chain issues. The listed language coverage includes Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust; framework coverage includes Spring Boot, Django, Flask, FastAPI, Express, and others named in the description. Standalone scripts use Python dependencies from `requirements.txt`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/dfyx-code-security-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/dfyx-code-security-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/dfyx-code-security-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/dfyx-code-security-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills dfyx-code-security-review
```

2. **Manually: put the files in place**
- File: `.github/skills/dfyx-code-security-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/dfyx-code-security-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/dfyx-code-security-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill dfyx-code-security-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/dfyx-code-security-review/SKILL.md

## When to use it
- audit a codebase for OWASP vulnerabilities
- trace input into SQL or command injection sinks
- find missing authorization checks
- inspect insecure configuration and dependencies
- prioritize findings and remediation work

## Example prompts
- Run a deep security audit of this codebase and trace practical attack paths.
- Check this project for injection, authentication, and authorization flaws.
- Review the dependencies and configuration against OWASP Top 10 risks.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md