Borrowing it
Nothing to install: this file belongs to ProgrammerAnthony/Expert-Coding-Harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ProgrammerAnthony/Expert-Coding-Harness/master/.cursor/skills/code-security-audit/SKILL.mdgit clone --depth 1 https://github.com/ProgrammerAnthony/Expert-Coding-HarnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/programmeranthony/expert-coding-harness/code-security-audit)<a href="https://agentmods.dev/skills/programmeranthony/expert-coding-harness/code-security-audit"><img src="https://agentmods.dev/badge/skills/programmeranthony/expert-coding-harness/code-security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/programmeranthony/expert-coding-harness/code-security-audit"><img src="https://agentmods.dev/badge/skills/programmeranthony/expert-coding-harness/code-security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.03036 |
| Opus 5.5 | $0.00051 | $0.01214 |
| Sonnet 5.5 | $0.00026 | $0.00607 |
| Haiku 4.5 | $0.00013 | $0.00304 |
Grade A, and why
code-security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码安全审计专家
铁律：所有漏洞发现必须有代码路径证据。 禁止基于"典型框架通常有此漏洞"等假设报告漏洞，未找到完整调用链的必须标记为"疑似，需人工验证"。
Inputs / Outputs / Gates / Handoffs（统一契约）
- Inputs（最小输入）：目标仓库/目录；技术栈线索（语言/框架/运行方式）；审计范围（模块/commit/接口）；扫描模式（Quick/Standard/Deep）。
- Outputs（产物形态）：审计计划（先）+ 结构化审计报告（后，结构参考
references/audit-report-template.md）。 - Gates（继续前必须满足）：
- 未经用户确认范围与模式，禁止开始扫描分析（保持与本文件 HARD-GATE 一致）。
- 结论必须有代码路径证据链（Source→Sink）；不完整链路必须标为“疑似，需人工验证”。
- 通用门控清单可复制使用：
references/quality-gates-checklist.md。
- Handoffs（推荐下游）：
writing-plans（实施计划编写）：输出修复计划subagent-driven-development（子代理驱动开发）：按计划执行修复code-security-audit（代码安全审计专家）：修复后复审
审计方法：三层分析法
| 层次 | 方法 | 目标 |
|---|---|---|
| 面 | Grep / 模式匹配 | 快速定位高风险区域，识别危险函数调用 |
| 线 | Read / 逐行追踪 | 完整数据流追踪，Source → Sink 路径分析 |
| 点 | 推理 / 逻辑验证 | 确认漏洞有效性、防护可绕过性、利用条件 |
扫描模式
启动时询问用户选择模式（默认 Standard）：
请选择扫描模式：
1. Quick（快速扫描，约 5-10 分钟）— 高危漏洞 + 敏感信息 + 已知 CVE
2. Standard（标准扫描，约 30-60 分钟）— OWASP Top 10 + 认证授权 + 加密
3. Deep（深度扫描，约 1-3 小时）— 全维度覆盖 + 攻击链 + 业务逻辑 + 合规
10 个安全维度 + 三轨模型
| # | 维度 | 审计轨道 | 覆盖内容 |
|---|---|---|---|
| D1 | 注入 | Sink-driven | SQL/Cmd/LDAP/SSTI/SpEL/JNDI |
| D2 | 认证 | Config-driven | Token/Session/JWT/Filter 链 |
| D3 | 授权 | Control-driven | CRUD 权限一致性、IDOR、水平越权 |
| D4 | 反序列化 | Sink-driven | Java/Python/PHP Gadget 链 |
| D5 | 文件操作 | Sink-driven | 上传/下载/路径遍历 |
| D6 | SSRF | Sink-driven | URL 注入、协议限制 |
| D7 | 加密 | Config-driven | 密钥管理、加密模式、KDF |
| D8 | 配置 | Config-driven | Actuator、CORS、错误信息暴露 |
| D9 | 业务逻辑 | Control-driven | 竞态条件、Mass Assignment、状态机、多租户隔离 |
| D10 | 供应链 | Config-driven | 依赖 CVE、版本检查 |
五阶段审计流程
Phase 1：侦察与架构建模（约 10% 工时）
目标：建立项目全貌，产出架构图和攻击面清单。
# 技术栈识别
ls -la
find . -name "package.json" -o -name "pom.xml" -o -name "requirements.txt" -o -name "go.mod" | head -20
# 入口点识别
rg "router|app.route|@RequestMapping|@Controller|@RestController" -l
# 配置文件识别
find . -name "*.yml" -o -name "*.yaml" -o -name "*.properties" -o -name "*.env" | head -20
# 敏感信息预扫
rg -i "password|secret|api_key|token|private_key" -l
What ships with it
33 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 2.7 KB
- references/audit-report-template.md 1.7 KB
- references/checklists/architecture-level-checklist.md 9.5 KB
- references/checklists/code-level-checklist.md 21 KB
- references/checklists/coverage-matrix.md 3.0 KB
- references/compliance/compliance-frameworks.md 3.2 KB
- references/devsecops-best-practices.md 6.6 KB
- references/examples/audit-examples.md 11 KB
- references/examples/config-file-vulnerabilities.md 17 KB
- references/examples/detailed-vulnerability-chains.md 34 KB
- references/examples/environment-simulation.md 8.8 KB
- references/examples/vulnerability-analysis.md 150 KB
- references/examples/vulnerability-cases.md 13 KB
- references/knowledge/anti-hallucination.md 2.3 KB
- references/knowledge/architecture-analysis.md 8.2 KB
- references/knowledge/attack-chain-analysis.md 7.8 KB
- references/knowledge/data-flow-analysis.md 6.6 KB
- references/knowledge/dependency-analysis.md 4.2 KB
- references/knowledge/pattern-scanning.md 12 KB
- references/knowledge/phase2-deep-methodology.md 14 KB
- references/knowledge/reporting.md 6.1 KB
- references/knowledge/secret-detection.md 5.4 KB
- references/knowledge/security-controls-matrix.yaml 3.3 KB
- references/knowledge/taint-analysis-enhanced.md 3.5 KB
- references/knowledge/vulnerability-validation.md 7.4 KB
- references/quality-gates-checklist.md 836 B
- references/rules/command-injection-rules.md 5.0 KB
- references/rules/sql-injection-rules.md 4.3 KB
- references/templates/architecture-diagram-templates.md 7.6 KB
- references/templates/report-template.md 14 KB
- references/templates/reproduction-steps-template.md 8.2 KB
- references/tools/security-tools.md 12 KB
- references/wooyun/wooyun-cases.md 36 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 228 lines · 128 tokens per session scan A d98d2b80f5dd
code-security-audit is a skill published in the GitHub repository ProgrammerAnthony/Expert-Coding-Harness (248 stars, last pushed 5mo ago), licensed MIT. It adds 128 tokens to every session and 3,036 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Structured code review through the shared OpenClaw agent-skills installation.
omh-code-review
This is an OMH code-review workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
explore-unknowns
Guide the user through a quadrant walk that maps the unknowns of a task — open by listing the known knowns, then work through known unknowns, unknown knowns, and unknown unknowns one stage at a time, ending with a complete four-quadrant map in the user's hands. Use when a request is ambiguous or underspecified, the…
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
asplos-writing-style
Use when drafting or revising ASPLOS prose — engineering the first two pages that rapid review actually reads, stating the cross-layer insight as one quotable sentence, structuring per-layer mechanism sections, writing bounded claims, and fitting everything into 11 self-contained pages that include figures and…