# Code Audit

> Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

- Skill: `netvar1337/code-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add netvar1337/code-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/code-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/code-audit

---


> Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

# Source Code Security Audit

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: read `../field-journal/precedent-pentest.md` or the code-audit authorization
2. `NOW`: confirm you have **source/repo access** (binary without source → switch to an RE skill)
3. `NOW`: clarify the language stack and scope (directories/services/PR diff)
4. `NEXT`: tool-index; semgrep etc.
5. `ACT`: threat-model sketch → automated scanning → manual verification

## Applicable Scenarios

- White-box auditing, PR/differential security review
- SAST with Semgrep / CodeQL / Bandit / gosec etc.
- Dangerous APIs, injection points, missing authz, crypto misuse
- Division of labor with `supply-chain-security/`: this skill focuses on **first-party code logic**; supply chain focuses on dependencies and pipelines

## Workflow

### 1. Scope and Threat Model

```text
□ Trust boundaries: user input, files, deserialization, SSRF, authz middleware
□ High-value assets: authentication, payments, admin panels, key handling
```

### 2. Automated Scanning

```bash
semgrep --config auto .
# or a project rule pack
semgrep --config p/owasp-top-ten .
```

### 3. Manual Verification (MUST)

```text
□ Every SAST hit: reachability? exploitability? false positive?
□ Authz: IDOR/broken access control, missing checks, broken multi-tenant isolation
□ Injection: SQL/command/template/LDAP
□ Crypto: hardcoded keys, ECB, custom crypto
```

### 4. Deliverables

```text
Finding: location + data flow + PoC + fix recommendation
Optional ATT&CK / CWE identifiers
```

## Toolchain

| Tool | Language/scenario |
|------|-----------|
| Semgrep | Fast multi-language rules |
| CodeQL | Deep data flow (GitHub) |
| Bandit | Python |
| gosec / staticcheck | Go |
| SpotBugs / FindSecBugs | Java |

## References

- `references/sast-review-checklist.md`
- `../supply-chain-security/` `../api-security/` `../llm-security/` (agent code)

## Routing Context

**Upstream**: MASTER R26  
**Role**: `ops/role-map.md` cae  
**Downstream**: dependency vulnerabilities → supply-chain; runtime validation → pentest-tools

## Task Completion Self-Check

- [ ] Manually verified rather than just pasting scanner output?
- [ ] Fix recommendations included?
- [ ] Confined to the authorized repo scope?
- [ ] Checklist?