Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add zhaoxuya520/reverse-skill/skills/code-auditCompatible with
Supported agents
| name | code-audit |
| description | Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification. |
NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权NOW: 确认有源码/仓库访问（无源码二进制 → 转 RE skill）NOW: 明确语言栈与范围（目录/服务/PR diff）NEXT: tool-index；semgrep 等ACT: 威胁建模草图 → 自动扫描 → 人工验证supply-chain-security/ 分工：本 skill 偏自有代码逻辑，供应链偏依赖与管道□ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产：鉴权、支付、管理端、密钥处理
semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .
□ 每个 SAST 命中：可达性？可利用性？误报？
□ 鉴权：IDOR/越权、缺校验、错误的多租户隔离
□ 注入：SQL/命令/模板/LDAP
□ 加密：硬编码密钥、ECB、自定义 crypto
Finding：位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号
| 工具 | 语言/场景 |
|---|---|
| Semgrep | 多语言快速规则 |
| CodeQL | 深数据流（GitHub） |
| Bandit | Python |
| gosec / staticcheck | Go |
| SpotBugs / FindSecBugs | Java |
references/sast-review-checklist.md../supply-chain-security/ ../api-security/ ../llm-security/（Agent 代码）上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain；运行时验证 → pentest-tools
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versioncode-auditExecute the skills CLI command in your project's root directory to begin installation:
epx add zhaoxuya520/reverse-skill/skills/code-auditFetches code-audit from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/code-audit
Restart Cursor to activate code-audit. Access via /code-auditin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
hardware-security
zhaoxuya520/reverse-skill · security · same repo
email-security
zhaoxuya520/reverse-skill · security · same repo
identity-federation
zhaoxuya520/reverse-skill · security · same repo
malware-analysis
zhaoxuya520/reverse-skill · security · same repo
digital-forensics
zhaoxuya520/reverse-skill · security · same repo
protocol-reverse
zhaoxuya520/reverse-skill · security · same repo
Keeps context tight: code-audit is the kind of skill you can hand to a new teammate without a long onboarding doc.
Keeps context tight: code-audit is the kind of skill you can hand to a new teammate without a long onboarding doc.
We added code-audit from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
code-audit is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Solid pick for teams standardizing on skills: code-audit is focused, and the summary matches what you get after install.
code-audit is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Keeps context tight: code-audit is the kind of skill you can hand to a new teammate without a long onboarding doc.
code-audit has been reliable in day-to-day use. Documentation quality is above average for community skills.
code-audit is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Registry listing for code-audit matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 64