Updated 1d ago
by ryo-ebata
cc-audit
AI-free static security scanner for Claude Code artifacts (Skills, Hooks, MCP configs). Detects data exfiltration, prompt injection, and supply chain risks with deterministic, reproducible results.
25 GitHub stars (25)
Steady at 25 stars — no new stars in the 16 days since Sep 30.
- 20 skills (20 skills found in its SKILL.md files)
- 3 forks (3 forks)
- 1d ago last update (Last updated 1d ago)
Install
Skills CLI
npx skills add ryo-ebata/cc-audit
Asks which skills and agents to install. Just one: npx skills add ryo-ebata/cc-audit --skill code-review-helper — add -g for every project.
Claude Code
git clone https://github.com/ryo-ebata/cc-auditcp -r "cc-audit/examples/clean" ~/.claude/skills/
Copies the code-review-helper skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add ryo-ebata/cc-audit
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
code-review-helper
A safe skill that helps with code review tasks
examples/clean/SKILL.md on GitHub (opens in a new tab) -
edge-case-test-skill
A skill with edge cases to test scanner boundary behavior
examples/edge-cases/SKILL.md on GitHub (opens in a new tab) -
suspicious-analytics
Skill that sends analytics data
examples/exfiltration/SKILL.md on GitHub (opens in a new tab) -
false-positive-test-skill
A skill containing patterns that should NOT trigger false positives
examples/false-positives/SKILL.md on GitHub (opens in a new tab) -
suspicious-executor
Skill that executes obfuscated code
examples/obfuscation/SKILL.md on GitHub (opens in a new tab) -
do-everything
A skill that requests all permissions
examples/overpermission/SKILL.md on GitHub (opens in a new tab) -
auto-scheduler
Skill that sets up scheduled tasks
examples/persistence/SKILL.md on GitHub (opens in a new tab) -
system-admin-helper
Skill with dangerous system commands
examples/privilege-escalation/SKILL.md on GitHub (opens in a new tab) -
helpful-assistant
A seemingly helpful skill with hidden instructions
examples/prompt-injection/SKILL.md on GitHub (opens in a new tab) -
config-manager
Skill that manages configuration
examples/secrets/SKILL.md on GitHub (opens in a new tab) -
quick-installer
Skill that installs dependencies quickly
examples/supply-chain/SKILL.md on GitHub (opens in a new tab) -
cli-architecture
CLI tool design and architecture best practices inspired by Biome, OxcLint, and other modern Rust tools. Use when designing new features, refactoring architecture, or reviewing structural decisions.
.claude/skills/cli-architecture/SKILL.md on GitHub (opens in a new tab) -
rust-best-practices
Rust coding best practices for cc-audit development. Use when writing new Rust code, reviewing code, or refactoring. Covers error handling, safety, performance, and idiomatic patterns.
.claude/skills/rust-best-practices/SKILL.md on GitHub (opens in a new tab) -
tdd-coach
Guide development using Kent Beck's TDD methodology. Use when implementing new features, fixing bugs, or adding rules to cc-audit. Enforces test-first approach with Red-Green-Refactor cycle.
.claude/skills/tdd-coach/SKILL.md on GitHub (opens in a new tab) -
complex-skill
A complex but safe skill for project scaffolding
tests/fixtures/benign/complex-skill/SKILL.md on GitHub (opens in a new tab) -
simple-skill
A simple and safe skill for code review
tests/fixtures/benign/simple-skill/SKILL.md on GitHub (opens in a new tab) -
data-exfil-skill
A skill that exfiltrates data
tests/fixtures/malicious/data-exfil/SKILL.md on GitHub (opens in a new tab) -
persistence-skill
A skill that establishes persistence
tests/fixtures/malicious/persistence/SKILL.md on GitHub (opens in a new tab) -
privilege-escalation-skill
A skill that escalates privileges
tests/fixtures/malicious/privilege-escalation/SKILL.md on GitHub (opens in a new tab) -
prompt-injection-skill
A skill with prompt injection
tests/fixtures/malicious/prompt-injection/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod…
-
reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries.
-
cavemanby JuliusBrussee 🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
-
JeecgBootby jeecgboot 【低代码v2.0，一句话即可生成整个系统】企业级AI低代码平台，一键生成前后端代码甚至整个系统。 AI Skills 一句话画流程、设计表单、生成报表、大屏。内置 AI应用平台涵盖：AI聊天、知识库、流程编排、MCP插件等，兼容主流大模型。引领AI低代码「Skills 生成 →…
-
frontend-slidesby zarazhangrui Create beautiful slides on the web using a coding agent's frontend skills
-
Claude-Code-Game-Studiosby Donchitos Turn Claude Code into a full game dev studio — 49 AI agents, 72 workflow skills, and a complete coordination system mirroring real studio h…