Updated 1d ago
by ryo-ebata
cc-audit
AI-free static security scanner for Claude Code artifacts (Skills, Hooks, MCP configs). Detects data exfiltration, prompt injection, and supply chain risks with deterministic, reproducible results.
26 GitHub stars (26)
+1 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | 0 |
| Oct 17 | +1 |
| Oct 18 | 0 |
| Oct 19 | 0 |
| Oct 20 | 0 |
| Oct 21 | 0 |
| Oct 22 | 0 |
| Oct 23 | 0 |
| Oct 24 | 0 |
| Oct 25 | 0 |
| Oct 26 | 0 |
| Oct 27 | 0 |
| Oct 28 | 0 |
| Oct 29 | 0 |
| Oct 30 | 0 |
| Oct 31 | 0 |
| Nov 1 | 0 |
| Nov 2 | 0 |
| Nov 3 | 0 |
| Nov 4 | 0 |
| Nov 5 | 0 |
- 20 skills (20 skills found in its SKILL.md files)
- 3 forks (3 forks)
- 1d ago last update (Last updated 1d ago)
Install
Skills CLI
npx skills add ryo-ebata/cc-audit
Asks which skills and agents to install. Just one: npx skills add ryo-ebata/cc-audit --skill code-review-helper — add -g for every project.
Claude Code
git clone https://github.com/ryo-ebata/cc-auditcp -r "cc-audit/examples/clean" ~/.claude/skills/
Copies the code-review-helper skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add ryo-ebata/cc-audit
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
code-review-helper
A safe skill that helps with code review tasks
examples/clean/ on GitHub (opens in a new tab)SKILL.md -
edge-case-test-skill
A skill with edge cases to test scanner boundary behavior
examples/edge-cases/ on GitHub (opens in a new tab)SKILL.md -
suspicious-analytics
Skill that sends analytics data
examples/exfiltration/ on GitHub (opens in a new tab)SKILL.md -
false-positive-test-skill
A skill containing patterns that should NOT trigger false positives
examples/false-positives/ on GitHub (opens in a new tab)SKILL.md -
suspicious-executor
Skill that executes obfuscated code
examples/obfuscation/ on GitHub (opens in a new tab)SKILL.md -
do-everything
A skill that requests all permissions
examples/overpermission/ on GitHub (opens in a new tab)SKILL.md -
auto-scheduler
Skill that sets up scheduled tasks
examples/persistence/ on GitHub (opens in a new tab)SKILL.md -
system-admin-helper
Skill with dangerous system commands
examples/privilege-escalation/ on GitHub (opens in a new tab)SKILL.md -
helpful-assistant
A seemingly helpful skill with hidden instructions
examples/prompt-injection/ on GitHub (opens in a new tab)SKILL.md -
config-manager
Skill that manages configuration
examples/secrets/ on GitHub (opens in a new tab)SKILL.md -
quick-installer
Skill that installs dependencies quickly
examples/supply-chain/ on GitHub (opens in a new tab)SKILL.md -
cli-architecture
CLI tool design and architecture best practices inspired by Biome, OxcLint, and other modern Rust tools. Use when designing new features, refactoring architecture, or reviewing structural decisions.
.claude/skills/ on GitHub (opens in a new tab)cli-architecture/ SKILL.md -
rust-best-practices
Rust coding best practices for cc-audit development. Use when writing new Rust code, reviewing code, or refactoring. Covers error handling, safety, performance, and idiomatic patterns.
.claude/skills/ on GitHub (opens in a new tab)rust-best-practices/ SKILL.md -
tdd-coach
Guide development using Kent Beck's TDD methodology. Use when implementing new features, fixing bugs, or adding rules to cc-audit. Enforces test-first approach with Red-Green-Refactor cycle.
.claude/skills/ on GitHub (opens in a new tab)tdd-coach/ SKILL.md -
complex-skill
A complex but safe skill for project scaffolding
tests/fixtures/ on GitHub (opens in a new tab)benign/ complex-skill/ SKILL.md -
simple-skill
A simple and safe skill for code review
tests/fixtures/ on GitHub (opens in a new tab)benign/ simple-skill/ SKILL.md -
data-exfil-skill
A skill that exfiltrates data
tests/fixtures/ on GitHub (opens in a new tab)malicious/ data-exfil/ SKILL.md -
persistence-skill
A skill that establishes persistence
tests/fixtures/ on GitHub (opens in a new tab)malicious/ persistence/ SKILL.md -
privilege-escalation-skill
A skill that escalates privileges
tests/fixtures/ on GitHub (opens in a new tab)malicious/ privilege-escalation/ SKILL.md -
prompt-injection-skill
A skill with prompt injection
tests/fixtures/ on GitHub (opens in a new tab)malicious/ prompt-injection/ SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.