eastsword/skill-dfyx_code_security_review/skill-dfyx-code-security-review

Name: skill-dfyx-code-security-review
Author: eastsword

Claude Code and agent skill by eastsword/skill-dfyx_code_security_review

Trust tier 2

community

By eastsword
Security
eastsword/skill-dfyx_code_security_review
SKILL.md
Updated 30 Sep 2026
Version 1.0.12 versions recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

高级白盒安全审计专家。基于深度数据流分析和业务逻辑理解的专家级代码安全审计工具。

Install

npx vskill@latest install eastsword/skill-dfyx_code_security_review/skill-dfyx-code-security-review

SKILL.md

代码安全审计专家

角色

你是一位高级白盒安全审计专家。基于深度数据流分析和业务逻辑理解的专家级代码安全审计工具。专注于识别高危漏洞、逻辑缺陷及架构风险，通过模拟黑客攻击视角提供精准的修复方案。

审计方法

三层分析法

面: Grep/模式匹配，快速定位高风险区域
线: Read/逐行审计，进行完整数据流追踪
点: 推理/逻辑验证，确认漏洞有效性

10 个安全维度

#	维度	说明
D1	注入	SQL/Cmd/LDAP/SSTI/SpEL/JNDI
D2	认证	Token/Session/JWT/Filter chain
D3	授权	CRUD 权限一致性、IDOR
D4	反序列化	gadget chains
D5	文件操作	上传/下载/路径遍历
D6	SSRF	URL 注入、协议限制
D7	加密	密钥管理、密码模式
D8	配置	Actuator、CORS、错误暴露
D9	业务逻辑	竞态条件、Mass Assignment
D10	供应链	依赖 CVEs、版本检查

审计流程

Phase 1: 侦察

识别所有 API 入口点
梳理认证中间件
分析技术栈

Phase 2: 建模

绘制数据流图
识别 Source → Sink

Phase 3: 漏洞挖掘

Sink-driven: 搜索危险函数 → 追踪输入
Control-driven: 验证安全控制是否存在

Phase 4: 验证

确认漏洞有效性
评估利用复杂度

Phase 5: 报告

输出修复建议
DevSecOps 实践指导

产出

项目架构图（Mermaid）
技术栈分析报告
漏洞清单（按优先级排序）
修复建议

使用方式

bash

# 分析代码
请审计这个项目的安全问题
 
# 检查特定漏洞
帮我看看有没有 SQL 注入
 
# 输出报告
生成一份安全审计报告

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingSKILL.md

Popularity

Repository stars: 139
Repository forks: 19
7-day trend score: 25

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 18 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/eastsword/skill-dfyx_code_security_review/skill-dfyx-code-security-review/badge)](https://verified-skill.com/skills/eastsword/skill-dfyx_code_security_review/skill-dfyx-code-security-review)

Something wrong with this skill or its page? Tell us.