How do I install the Code Audit skill?

Run npx skillmds@latest add netvar1337/code-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Audit free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Code Audit?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Audit by netvar1337 — Agent Skill

Name: Code Audit
Author: netvar1337

File contents

Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

Source Code Security Audit

ACTION REQUIRED (execute immediately after reading)

NOW: read ../field-journal/precedent-pentest.md or the code-audit authorization
NOW: confirm you have source/repo access (binary without source → switch to an RE skill)
NOW: clarify the language stack and scope (directories/services/PR diff)
NEXT: tool-index; semgrep etc.
ACT: threat-model sketch → automated scanning → manual verification

Applicable Scenarios

White-box auditing, PR/differential security review
SAST with Semgrep / CodeQL / Bandit / gosec etc.
Dangerous APIs, injection points, missing authz, crypto misuse
Division of labor with supply-chain-security/: this skill focuses on first-party code logic; supply chain focuses on dependencies and pipelines

Workflow

1. Scope and Threat Model

□ Trust boundaries: user input, files, deserialization, SSRF, authz middleware
□ High-value assets: authentication, payments, admin panels, key handling

2. Automated Scanning

semgrep --config auto .
# or a project rule pack
semgrep --config p/owasp-top-ten .

3. Manual Verification (MUST)

□ Every SAST hit: reachability? exploitability? false positive?
□ Authz: IDOR/broken access control, missing checks, broken multi-tenant isolation
□ Injection: SQL/command/template/LDAP
□ Crypto: hardcoded keys, ECB, custom crypto

4. Deliverables

Finding: location + data flow + PoC + fix recommendation
Optional ATT&CK / CWE identifiers

Toolchain

Tool	Language/scenario
Semgrep	Fast multi-language rules
CodeQL	Deep data flow (GitHub)
Bandit	Python
gosec / staticcheck	Go
SpotBugs / FindSecBugs	Java

References

references/sast-review-checklist.md
../supply-chain-security/ ../api-security/ ../llm-security/ (agent code)

Routing Context

Upstream: MASTER R26
Role: ops/role-map.md cae
Downstream: dependency vulnerabilities → supply-chain; runtime validation → pentest-tools

Task Completion Self-Check

Manually verified rather than just pasting scanner output?
Fix recommendations included?
Confined to the authorized repo scope?
Checklist?

---name: code-auditdescription: Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.license: MIT---> Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill# Source Code Security Audit## ACTION REQUIRED (execute immediately after reading)1. `NOW`: read `../field-journal/precedent-pentest.md` or the code-audit authorization2. `NOW`: confirm you have **source/repo access** (binary without source → switch to an RE skill)3. `NOW`: clarify the language stack and scope (directories/services/PR diff)4. `NEXT`: tool-index; semgrep etc.5. `ACT`: threat-model sketch → automated scanning → manual verification## Applicable Scenarios- White-box auditing, PR/differential security review- SAST with Semgrep / CodeQL / Bandit / gosec etc.- Dangerous APIs, injection points, missing authz, crypto misuse- Division of labor with `supply-chain-security/`: this skill focuses on **first-party code logic**; supply chain focuses on dependencies and pipelines## Workflow### 1. Scope and Threat Model```text□ Trust boundaries: user input, files, deserialization, SSRF, authz middleware□ High-value assets: authentication, payments, admin panels, key handling```### 2. Automated Scanning```bashsemgrep --config auto .# or a project rule packsemgrep --config p/owasp-top-ten .```### 3. Manual Verification (MUST)```text□ Every SAST hit: reachability? exploitability? false positive?□ Authz: IDOR/broken access control, missing checks, broken multi-tenant isolation□ Injection: SQL/command/template/LDAP□ Crypto: hardcoded keys, ECB, custom crypto```### 4. Deliverables```textFinding: location + data flow + PoC + fix recommendationOptional ATT&CK / CWE identifiers```## Toolchain| Tool | Language/scenario ||------|-----------|| Semgrep | Fast multi-language rules || CodeQL | Deep data flow (GitHub) || Bandit | Python || gosec / staticcheck | Go || SpotBugs / FindSecBugs | Java |## References- `references/sast-review-checklist.md`- `../supply-chain-security/` `../api-security/` `../llm-security/` (agent code)## Routing Context**Upstream**: MASTER R26 **Role**: `ops/role-map.md` cae **Downstream**: dependency vulnerabilities → supply-chain; runtime validation → pentest-tools## Task Completion Self-Check- [ ] Manually verified rather than just pasting scanner output?- [ ] Fix recommendations included?- [ ] Confined to the authorized repo scope?- [ ] Checklist?

Frequently asked questions

Code Audit