Guide · Agent skill
How to use the Source Code Security Audit agent skill (code-audit)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The code-audit skill is a set of instructions and a checklist that tells an AI agent how to review source code for security flaws. It is aimed at security engineers doing authorized white-box reviews, developers checking a pull request or service, and students learning how static analysis findings are triaged. After this guide you will know what the skill does, how to install it, how to ask for a review in plain language, and what it needs before it starts.
Source Code Security Auditzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download the ZIP. Download the code-audit skill ZIP from this page.
- 2Unzip into a skills folder. Place the folder in ~/.claude/skills/ for personal use, or .claude/skills/ inside a project.
- 3Confirm authorization and scope. Write down what you are allowed to review and which directory, service or PR diff is in scope.
- 4Install your scanners. Install the SAST tools you plan to use, such as Semgrep, CodeQL, Bandit, gosec or SpotBugs.
- 5Ask for the review. Describe the task in plain language, naming the scope and stating that you have authorization.
- 6Verify each finding. Check every scanner hit for reachability, exploitability and false positives before accepting it.
What the code-audit skill makes the agent do
The skill sets a fixed workflow for a source-code security review. The agent first confirms the scope and writes a short threat model that marks trust boundaries such as user input, file handling, deserialization, SSRF and auth middleware, plus high-value assets such as authentication, payments, admin areas and key handling.
It then runs static analysis (SAST) tools. The skill's examples use Semgrep, and its toolchain table also lists CodeQL, Bandit for Python, gosec and staticcheck for Go, and SpotBugs with FindSecBugs for Java.
Every scanner hit must then be checked by hand: is it reachable, is it exploitable, or is it a false positive. The skill is explicit that scanner output alone is not a finding. Confirmed issues are reported with location, data flow, a proof of concept and a fix suggestion, and may be tagged with CWE or ATT&CK identifiers.
Install the code-audit skill
Download the skill ZIP from this page. Unzip it into one of two places, depending on how you want to use it. For a personal setup, put the folder in ~/.claude/skills/. For a single project, put it in the project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside the project
- Claude apps: Settings → Capabilities → Skills, then upload
Prepare the review before you ask
The skill will not start a review without a written authorization or a defined scope. Its SKILL.md tells the agent to read ../field-journal/precedent-pentest.md or confirm written code-audit authorization. The skill also needs access to the source code or repository. If you only have compiled binaries, the skill says to use a reverse-engineering skill instead.
Decide the language stack and the scope before you start: a directory, a service, or a pull request diff. Install the scanners you plan to use, such as Semgrep, CodeQL, Bandit, gosec, SpotBugs or similar. The skill does not install them for you.
- Source code or a repository you can access
- Written authorization, or the referenced file ../field-journal/precedent-pentest.md
- A defined scope: directory, service or PR diff
- Scanners installed locally as needed
Run a review with natural requests
You do not need special syntax. Describe the task and name the scope. The agent will load the skill when the request matches its purpose of authorized source-code security review and SAST work. Say what you are authorized to review, and point it at the code.
Example requests you can adapt:
- Review the payments/ directory of this repo for injection and auth flaws. I have written authorization.
- Run a Semgrep scan on the diff of this pull request and verify each hit manually.
- Audit the Python services in src/api for insecure deserialization and hardcoded keys. Use Bandit where it applies.
- Check this Go service for dangerous exec calls and crypto misuse, then suggest fixes.
semgrep --config auto .Read the output and verify the findings
The skill's first scanner step is a Semgrep run using the auto config, and an alternative using the OWASP Top Ten rule pack (p/owasp-top-ten). Treat these as leads. The skill's checklist asks whether each hit is reachable, exploitable or a false positive, and checks areas such as IDOR and privilege escalation, SQL, command, template and LDAP injection, and crypto misuse like hardcoded keys or ECB mode.
Before you accept the report, check that each finding includes its location, data flow, proof of concept and fix suggestion.
- Did the agent verify each scanner hit, rather than pasting scanner output?
- Does each finding include a fix suggestion?
- Does the review stay inside the authorized repository and scope?
Safety notes: scripts and network
The skill runs scripts, so it can execute commands in your environment. Review what it runs before you approve it, and keep to the scanners you have chosen. The skill does not use the network, according to its listing.
The skill is built around offensive-style proof-of-concept work. Only run it against code you own or are authorized to test. Dependency and supply-chain scanning is routed by the skill to a separate supply-chain security skill, and runtime testing to a pentest tools skill.
- Runs scripts: yes. Uses network: no.
- Only review code you have written permission to test.
- Use it for source code, not compiled binaries.
What people use it for
- Reviewing a service's authentication and authorization code for IDOR and privilege escalation.
- Checking a pull request diff for injection, dangerous exec calls and hardcoded keys.
- Triaging Semgrep or CodeQL results to separate real issues from false positives.
- Learning how SAST findings are verified, using the checklist as a worked example.
Frequently asked questions
Is the code-audit skill free?
The source provided for this guide does not state pricing or licence terms beyond the listing's licence, which is MIT. Check the repository's licence file for the full terms before you use or redistribute it.
What do I need to use the code-audit skill?
You need access to the source code or repository, written authorization or the referenced file ../field-journal/precedent-pentest.md, and any scanners you plan to use, such as Semgrep, CodeQL, Bandit, gosec or SpotBugs. The skill does not install these scanners for you.
How do I install a skill from a ZIP file?
Unzip the downloaded folder into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
Can the code-audit skill review compiled binaries?
No. The skill is for source code. If you only have a compiled binary with no source, the skill says to use a reverse-engineering skill instead.
Does the skill scan dependencies for vulnerabilities?
Not as its main job. The skill focuses on your own code logic and routes dependency and supply-chain vulnerabilities to a separate supply-chain-security skill.
How does code-audit compare with running Semgrep or CodeQL directly?
Running a scanner gives you raw hits. The skill adds a structured workflow: a threat model, scanner runs, manual checks for reachability and false positives, and a report with proof of concept and fixes. The scanners remain the engine.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use code-audit if you are a security engineer, developer or student doing authorized white-box reviews of source code and want a checklist-driven, verified workflow. Pick something else if you need dependency scanning, binary analysis, or a tool for code you have no permission to test.
Download the skill