Skip to main content
affpapa.org
RU EN
skill CX Codex

eastsword-dfyx-code-security-review — Claude Code skill: setup guide

This skill runs white-box security audits by tracking data flows and spotting authorization or injection flaws. It suits projects preparing code for production.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a claude-code
Open on GitHub

What eastsword-dfyx-code-security-review does

The skill runs a five-stage white-box audit. It begins by mapping the application structure and listing external entry points. Next, it looks for suspicious patterns and traces untrusted inputs to sensitive sinks. It covers 10 risk categories, including injections, deserialization, file operations, and SSRF.

It covers 9 programming languages. Its detection logic references WooYun vulnerability cases from 2010 to 2016. Supported stacks include Java, Go, PHP, Python, C/C++, Rust, and C#. It also accounts for 14 web frameworks like Spring Boot, Django, Fastify, and Rails.

Running the bundled helper scripts requires Python. Without running pip install -r requirements.txt, those standalone scanner utilities will fail.

What it helps with

  • Locate SQL and command injection flaws across application files
  • Trace tainted user input directly to unvalidated sinks
  • Identify API endpoints lacking authorization checks
  • Flag unsafe deserialization and SSRF pathways in supported frameworks

Example prompts for the agent

  • Run a dfyx security audit on this project to find vulnerabilities
  • Trace untrusted data flows from HTTP requests to database queries
  • Check our controllers and services for authorization flaws

How to install eastsword-dfyx-code-security-review

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a claude-code

2Manually: put the files in place

~/.claude/skills/eastsword-dfyx-code-security-review/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/eastsword-dfyx-code-security-review/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about eastsword-dfyx-code-security-review

How to install eastsword-dfyx-code-security-review in Claude Code?

Run npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a claude-code in your terminal. The skill file is placed in ~/.claude/skills/eastsword-dfyx-code-security-review/SKILL.md.

What does eastsword-dfyx-code-security-review do?

It performs a five-phase static code security audit. The skill inspects application entry points, scans for vulnerable patterns, and tracks tainted data paths to sensitive sinks.

Which languages and frameworks does this skill support?

It covers 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, and Rust. Supported web frameworks include Spring Boot, Django, Flask, Express, Gin, and Rails.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

dfyx-code-security-review This skill performs white-box static analysis of code, tracing data flows and checking security controls, configuration, and business logic. Use it for a deep project audit. CX Codex +1 338installs pentestops-dashboard This skill guides an agent through setting up a dashboard for penetration testing projects, tasks, findings, clients, and assets. Use it to organize an assessment workflow. CX Codex +1 336installs dfyx-code-security-auditor A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment. CX Codex +1 334installs dfyx-code-security-audit This skill audits source code for vulnerabilities through data-flow analysis and business-logic review. Use it for a project security check or pentest preparation. CX Codex +1 328installs pentest-skills-framework A modular skill for reconnaissance, vulnerability checks, and result analysis through natural-language requests. It fits AI CLI penetration-testing workflows. CX Codex +1 327installs security-investigator-automation A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request. CX Codex +1 322installs malwarebytes-premium-security-cracked-distribution This skill covers a pirated, pre-activated Malwarebytes Premium build and flags the security and legal risks. It should not be used to obtain cracked software. CX Codex +1 320installs linux-pentester-commands A Linux command reference for reconnaissance, enumeration, exploitation, and privilege escalation during authorized penetration testing. CX Codex +1 319installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor