code-audit（代码审计）

Code Audit Skill

专业代码安全审计技能 | Professional Code Security Audit 支持模式: quick / standard / deep

When to Use This Skill

This skill should be used when:

• User requests code audit, security audit, or vulnerability scanning
• User asks to check code security or find security issues
• User mentions /audit or /code-audit
• User wants to review code for vulnerabilities before deployment
• User needs penetration testing preparation or security assessment

Trigger phrases:

• "审计这个项目" / "Audit this project"
• "检查代码安全" / "Check code security"
• "找出安全漏洞" / "Find security vulnerabilities"
• "/audit", "/code-audit"

Quick Reference

Scan Modes

Core Workflow

1. Reconnaissance   → Identify tech stack, map attack surface
2. Vulnerability Hunt → Search patterns, trace data flow
3. Verification    → Confirm exploitability, filter false positives
4. Docker Verify   → [NEW] Dynamic verification in sandbox (optional)
5. Report          → Document findings with PoC and fixes

Docker部署验证

对于深度审计，可使用Docker沙箱进行动态验证:

# 生成验证环境
code-audit --generate-docker-env

# 启动并验证
docker-compose up -d
docker exec -it sandbox python /workspace/poc/verify_all.py

详见: references/core/docker_verification.md

Execution Controller（执行控制器 — 必经路径）

⚠️ 以下步骤是审计执行的必经路径，不是参考建议。 每步有必须产出的输出，后续步骤依赖前序输出。不产出 = 用户可见缺失。

Step 1: 模式判定

根据用户指令确定审计模式：

反降级规则: 用户指定的模式不可自行降级。项目规模大不是降级理由，而是启用 Multi-Agent 的理由。降级需用户明确确认。

必须输出:

[MODE] {quick|standard|deep}

Step 2: 文档加载

按模式加载必要文档（用 Read 工具实际读取，不是"知道有这个文件"）：

deep 模式下 agent.md 是必读文档 — Step 4 的执行计划模板包含只有 agent.md 中才有的字段（维度权重、Agent 切分模板、门控条件、执行状态机）。

必须输出:

[LOADED] {实际 Read 的文档列表，含行数}

Step 3: 侦察（Reconnaissance）

对目标项目执行攻击面测绘。

必须输出:

[RECON]
项目规模: {X files, Y directories}
技术栈: {language, framework, version}
项目类型: {CMS | 金融 | SaaS | 数据平台 | 身份认证 | IoT | 通用Web}
入口点: {Controller/Router/Handler 数量}
关键模块: {列表}

Step 4: 执行计划 → STOP

基于 Step 1-3 的输出生成执行计划。输出后暂停，等待用户确认才能继续。

quick/standard 模板:

[PLAN]
模式: {mode}
技术栈: {from Step 3}
扫描维度: {计划覆盖的 D1-D10 维度}
已加载文档: {from Step 2}

deep 模板（全部字段必填 — 标注了信息来源文档）:

[PLAN]
模式: deep
项目规模: {from Step 3}
技术栈: {from Step 3}
维度权重: {from agent.md 状态机 → 项目类型维度权重，如 CMS: D5(++), D1(+), D3(+), D6(+)}
Agent 方案: {from agent.md Agent 模板 → 每个 Agent 负责的维度和 max_turns}
Agent 数量: {from agent.md 规模建议 → 小型(<10K) 2-3, 中型(10K-100K) 3-5, 大型(>100K) 5-9}
D9 覆盖策略: {若项目有后台管理/多角色/多租户 → D9 必查，D3 Agent 须同时覆盖 D9a(IDOR+权限一致性+Mass Assignment)}
轮次规划: R1 广度扫描 → R1 评估 → R2 增量补漏(按需)
门控条件: PHASE_1_RECON → ROUND_N_RUNNING → ROUND_N_EVALUATION → REPORT
预估总 turns: {Agent数 × max_turns}
已加载文档: {from Step 2}

⚠️ STOP — 输出执行计划后暂停。等待用户确认后才能开始审计。

Step 5: 执行

用户确认后，按执行计划和已加载文档执行：

• quick: 高危模式匹配扫描，直接输出
• standard: 按 Phase 1→5 顺序执行
• deep: 严格按 agent.md 执行状态机

- 启动 Multi-Agent 并行（按 Step 4 确认的 Agent 方案） - 遵守每个 State 的门控条件 - 轮次评估使用 agent.md 三问法则

Step 6: 报告门控

生成报告前验证：

不满足前置条件 → 不得生成最终报告。

Anti-Hallucination Rules (MUST FOLLOW)

⚠️ Every finding MUST be based on actual code read via tools

✗ Do NOT guess file paths based on "typical project structure"
✗ Do NOT fabricate code snippets from memory
✗ Do NOT report vulnerabilities in files you haven't read

✓ MUST use Read/Glob to verify file exists before reporting
✓ MUST quote actual code from Read tool output
✓ MUST match project's actual tech stack

Core principle: Better to miss a vulnerability than report a false positive.

Anti-Confirmation-Bias Rules (MUST FOLLOW)

⚠️ Audit MUST be methodology-driven, NOT case-driven

✗ Do NOT say "基于之前的审计经验，我将重点关注..."
✗ Do NOT prioritize certain vuln types based on "known CVEs"
✗ Do NOT skip checklist items because they seem "less likely"

✓ MUST enumerate ALL sensitive operations, then verify EACH one
✓ MUST complete the full checklist for EACH vulnerability type
✓ MUST treat all potential vulnerabilities with equal rigor

Core principle: Discover ALL potential vulnerabilities, not just familiar patterns.

Two-Layer Checklist (两层检查清单)

Layer 1: coverage_matrix.md — Phase 2A后加载，验证10个安全维度覆盖率 Layer 2: 语言语义提示 — 仅对未覆盖维度按需加载对应段落

核心原则: Checklist 不驱动审计，而是验证覆盖。LLM 先自由审计(Phase 2A)，再用矩阵查漏(Phase 2B)。

Module Reference

Core Modules (Load First)

Language Modules (Load by Tech Stack)

Security Domain Modules (Load as Needed)

Tool Priority Strategy

Priority 1: External Professional Tools (if available)
├─ semgrep scan --config auto          # Multi-language SAST
├─ bandit -r ./src                      # Python security
├─ gosec ./...                          # Go security
└─ gitleaks detect                      # Secret scanning

Priority 2: Built-in Analysis (always available)
├─ LSP semantic analysis                # goToDefinition, findReferences, incomingCalls
├─ Read + Grep pattern matching         # Core analysis
└─ Module knowledge base                # 55+ vuln patterns

Priority 3: Verification
├─ PoC templates from references/core/poc_generation.md
└─ Confidence scoring from references/core/verification_methodology.md

Detailed Documentation

For complete audit methodology, vulnerability patterns, and detection rules, see:

• Full Workflow: agent.md - Complete audit process and detection commands
• Vulnerability Details: references/ - Language/framework-specific patterns
• Tool Integration: references/core/external_tools_guide.md
• Report Templates: references/core/taint_analysis.md

Version

• Current: 1.0
• Updated: 2026-02-13

v1.0 (Initial Public Release)

• 9语言143项强制检测清单 (references/checklists/)
• 双轨并行审计框架: Sink-driven + Control-driven + Config-driven
• Docker部署验证框架 (references/core/docker_verification.md)
• WooYun 88,636案例库集成
• 安全控制矩阵框架