# eastsword-dfyx-code-security-review

This skill runs white-box security audits by tracking data flows and spotting authorization or injection flaws. It suits projects preparing code for production.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 327 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/eastsword-dfyx-code-security-review/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/eastsword-dfyx-code-security-review

## What it does

The skill runs a five-stage white-box audit. It begins by mapping the application structure and listing external entry points. Next, it looks for suspicious patterns and traces untrusted inputs to sensitive sinks. It covers 10 risk categories, including injections, deserialization, file operations, and SSRF.

It covers 9 programming languages. Its detection logic references WooYun vulnerability cases from 2010 to 2016. Supported stacks include Java, Go, PHP, Python, C/C++, Rust, and C#. It also accounts for 14 web frameworks like Spring Boot, Django, Fastify, and Rails.

Running the bundled helper scripts requires Python. Without running `pip install -r requirements.txt`, those standalone scanner utilities will fail.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/eastsword-dfyx-code-security-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/eastsword-dfyx-code-security-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/eastsword-dfyx-code-security-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/eastsword-dfyx-code-security-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills eastsword-dfyx-code-security-review
```

2. **Manually: put the files in place**
- File: `.github/skills/eastsword-dfyx-code-security-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/eastsword-dfyx-code-security-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/eastsword-dfyx-code-security-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill eastsword-dfyx-code-security-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/eastsword-dfyx-code-security-review/SKILL.md

## When to use it
- Locate SQL and command injection flaws across application files
- Trace tainted user input directly to unvalidated sinks
- Identify API endpoints lacking authorization checks
- Flag unsafe deserialization and SSRF pathways in supported frameworks

## Example prompts
- Run a dfyx security audit on this project to find vulnerabilities
- Trace untrusted data flows from HTTP requests to database queries
- Check our controllers and services for authorization flaws

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md