agentmods.dev

code-audit

code-audit is a skill for Claude Code from skillmds/skillmd. It costs 31 tokens per session (676 once invoked), scanned A, a copy of code-audit, MIT.

A source-code security review workflow for checking authorised code with scanners such as Semgrep and CodeQL, followed by human verification.

In plain words
What is it for?
It is for reviewing application code, pull-request changes, and security findings, then recording each issue with its location, evidence, and suggested fix.
Why use it?
It helps find security problems that automated scans may miss or report incorrectly, such as injection flaws, missing access checks, and unsafe cryptography.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the code-security-review-pipeline plugin — 15 skills shipped together

not rated 143repo +49 4d ago A scan 31 tokens copy · 100% MIT

Good fit It is for reviewing application code, pull-request changes, and security findings, then recording each issue with its location, evidence, and suggested fix.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/skillmds/skillmd/code-audit
View source ↗ skillmds/skillmd skillmd.com
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add skillmds/skillmd --skill code-audit
Clone the repo
git clone --depth 1 https://github.com/skillmds/skillmd

Made for: Claude Code.

Or install code-security-review-pipeline, the plugin that ships this one along with the rest of its 15 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-audit

README.md
[![agentmods](https://agentmods.dev/badge/skills/skillmds/skillmd/code-audit/github.svg)](https://agentmods.dev/skills/skillmds/skillmd/code-audit)
Your own site
<a href="https://agentmods.dev/skills/skillmds/skillmd/code-audit"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/code-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-audit

Your own site · 80×15
<a href="https://agentmods.dev/skills/skillmds/skillmd/code-audit"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 676 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.00676
Opus 5.5 $0.00012 $0.00270
Sonnet 5.5 $0.00006 $0.00135
Haiku 4.5 $0.00003 $0.00068

Measured 1mo ago against content hash 122dafd86828, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to code-audit — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

plugins/code-security-review-pipeline/skills/code-audit/SKILL.md · 82 lines

What it actually says

Source Code Security Audit

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权
  2. NOW: 确认有源码/仓库访问（无源码二进制 → 转 RE skill）
  3. NOW: 明确语言栈与范围（目录/服务/PR diff）
  4. NEXT: tool-index；semgrep 等
  5. ACT: 威胁建模草图 → 自动扫描 → 人工验证

适用场景

  • 白盒审计、PR/差分安全审查
  • Semgrep / CodeQL / Bandit / gosec 等 SAST
  • 危险 API、注入点、鉴权缺失、加密误用
  • 与 supply-chain-security/ 分工：本 skill 偏自有代码逻辑，供应链偏依赖与管道

工作流

1. 范围与威胁模型

□ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产：鉴权、支付、管理端、密钥处理

2. 自动扫描

semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .

3. 人工验证（MUST）

□ 每个 SAST 命中：可达性？可利用性？误报？
□ 鉴权：IDOR/越权、缺校验、错误的多租户隔离
□ 注入：SQL/命令/模板/LDAP
□ 加密：硬编码密钥、ECB、自定义 crypto

4. 产出

Finding：位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号

工具链

工具 语言/场景
Semgrep 多语言快速规则
CodeQL 深数据流（GitHub）
Bandit Python
gosec / staticcheck Go
SpotBugs / FindSecBugs Java

参考

  • references/sast-review-checklist.md
  • ../supply-chain-security/ ../api-security/ ../llm-security/（Agent 代码）

路由上下文

上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain；运行时验证 → pentest-tools

任务完成自检

  • 是否人工验证而非只贴扫描器输出？
  • 是否含修复建议？
  • 是否限定在授权仓库范围？
  • Checklist？
Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 82 lines · 31 tokens per session scan A 122dafd86828

Subscribe to this mod's changes

code-audit is a skill published in the GitHub repository skillmds/skillmd (143 stars, last pushed 4d ago), licensed MIT. It adds 31 tokens to every session and 676 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to code-audit, differing in 0 lines, and is treated as a copy.

Code reviewLintSecurityagent-skillsai-agentsclaudeclimcp
Related

code-audit compared with skills from other repositories

code-audit next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
code-auditskillmds/skillmdSkill1434d agoMITA31Claude Code
find-simplificationsQwenLM/qwen-codeSkill29ktodayApache-2.0C103Claude Code, Codex
swarm-pr-reviewZaxbyHub/opencode-swarmSkill517todayMITA91Claude Code
code-reviewjrswab/axeSkill90916d agoApache-2.0A0Claude Code, Codex
agent-debug-ciNVIDIA/elementsSkill115todayApache-2.0A80Claude Code, Codex
audit-ciNVIDIA/elementsSkill115todayApache-2.0A78Claude Code, Codex
reviewanton-abyzov/specweaveSkill170todayMITA45Claude Code, Codex