Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/source-code-audit/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/source-code-audit)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/source-code-audit"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/source-code-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/source-code-audit"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/source-code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.00794 |
| Opus 5.5 | $0.00030 | $0.00318 |
| Sonnet 5.5 | $0.00015 | $0.00159 |
| Haiku 4.5 | $0.00007 | $0.00079 |
Grade A, and why
source-code-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
eval / exec / os.system / subprocess / pickle.loads What it actually says
source-code-audit — 源码审计专项深度挖掘
何时调用（触发条件）
- 有源码（开源项目/泄露代码/反编译产物）
- 用户给代码片段要求审计
- 前端 source map 还原出完整源码
- APK 反编译后需要审计 Java/so 层
- 需要定位：拼接、反序列化、模板渲染、命令执行、文件操作、鉴权分支
一、静态审计方法（SAST）
核心思路
输入点 → 传播链 → 危险函数（Sink）
审计关注
- 拼接：SQL/命令/路径/模板
- 反序列化：unserialize/readObject/pickle
- 模板渲染：用户输入进入模板引擎
- 命令执行：exec/system/ProcessBuilder
- 文件操作：上传/下载/包含/删除
- 鉴权分支：哪些接口缺少权限校验
输出格式
- 可疑调用链（输入 → 传播 → Sink）
- 关键代码片段
- 缺陷触发条件（参数、前置校验）
二、危险函数速查（按语言）
PHP
eval / assert / system / exec / passthru / shell_exec / popen
include / require / file_get_contents / unserialize
preg_replace(e修饰符) / create_function / $$变量覆盖
Java
Runtime.exec / ProcessBuilder / readObject / XMLDecoder
SpEL / OGNL / MVEL / EL表达式
JNDI lookup / JdbcRowSetImpl / TemplatesImpl
Python
eval / exec / os.system / subprocess / pickle.loads
yaml.load(Loader=Loader) / __import__ / compile
Node.js
eval / Function() / child_process / vm.runInContext
__proto__ / constructor.prototype（原型污染）
Go
os/exec.Command / text/template（SSTI）
sql拼接 / 不安全的反序列化
三、鉴权审计要点
- 接口/路由是否有统一鉴权中间件
- 是否存在免鉴权路径（白名单/静态资源/回调）
- 角色判断是否可信（前端传角色 vs 服务端查库）
- 对象级校验：是否只校验登录不校验归属
- 管理接口与普通接口的权限边界
四、结合其他技能
审计发现的具体漏洞类型转对应技能深化：
- 注入点 →
injection-vulns - 反序列化 →
deserialization-xxe - 文件操作 →
file-handling - 鉴权缺陷 →
auth-access-control - 加密/签名算法 →
auth-access-control
五、输出与报告要点
- 每个漏洞：输入点 / 传播链 / Sink / 缺失的校验
- 附代码片段与触发条件
- 可利用性评估（前置条件、影响面）
- 修复方案（代码级）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 94 lines · 75 tokens per session scan A a5334ead822a
source-code-audit is a skill published in the GitHub repository zhaji2333/CkSKILLS (126 stars, last pushed 1mo ago), licensed MIT. It adds 75 tokens to every session and 794 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
new
Create a new project to start development quickly.
xcode-compilation-analyzer
Analyze Swift and mixed-language compile hotspots using build timing summaries and Swift frontend diagnostics, then produce a recommend-first source-level optimization plan. Use when a developer reports slow compilation, type-checking warnings, expensive clean-build compile phases, long CompileSwiftSources tasks…
cli-builder
Build production-quality CLIs with language detection and a five-step approval-gated workflow. Use when wrapping an existing module or app. Don't use for GUI/TUI apps, web APIs, or one-off shell scripts.
rails-dev
Opinionated Rails conventions: rich models, concerns, CRUD-everything, state-as-records, minimal dependencies, Minitest with fixtures. Load this skill BEFORE any code-level thinking, not only before editing a file. It is required the moment a task touches Rails code in ANY way: designing or even just discussing a data…
hashiiiii-zig
Use when writing, editing, or reviewing Zig implementation, tests, build files, or CI.
paper2code
Converts an arxiv paper into a minimal, citation-anchored Python implementation. Trigger when user runs /paper2code with an arxiv URL or paper ID, says "implement this paper", or pastes an arxiv link asking for implementation. Flags all ambiguities honestly. Never invents implementation details not stated in the paper.