Updated 3mo ago
by zhiyuwang720-dev
CodeAuditSkill
CodeAuditSkill 是一个运行在 Claude Code 中的 Web 项目安全代码审计/漏洞挖掘 Skill, 已经获得了40余个CNVD漏洞编号。 给定一个 Web 项目目录,自动识别语言与框架,按语言专属漏洞清单进行系统化源码审计,对每条高中危漏洞并行启动子 Agent 进行可利用性验证,最终输出可交付的审计报告。
48 GitHub stars (48)
Steady at 48 stars — no new stars in the 16 days since Sep 30.
- 1 skill (1 skills found in its SKILL.md files)
- 0 forks (0 forks)
- 3mo ago last update (Last updated 3mo ago)
Install
Skills CLI
npx skills add zhiyuwang720-dev/CodeAuditSkill
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/zhiyuwang720-dev/CodeAuditSkillcp -r "CodeAuditSkill/skills/web-vuln-audit" ~/.claude/skills/
Copies the web-vuln-audit skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add zhiyuwang720-dev/CodeAuditSkill
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
web-vuln-audit
Web 项目安全代码审计 skill,自动识别 Go / Java / Python / PHP / JavaScript 项目类型并加载对应漏洞清单(SQL/SSRF/XSS/CSRF/反序列化/路径穿越/鉴权/命令注入/XXE 等),输出审计报告到被审计项目的 reports/ 目录。适用于:(1) 单仓库 Web 项目的中高危漏洞扫描,(2) 自动生成可复现的漏洞报告(含代码位置、复现 curl、修复建议、修复后验证),(3) 对每条漏洞并行启动子 Agent 进行可利用性验证,输出 PoC 步骤或误判说明。只审计 High/Medium,跳过 Low。
skills/web-vuln-audit/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.