code-audit
Code Audit is a professional security analysis agent skill designed for Claude Code that performs white-box static code analysis to identify vulnerabilities in source code. It supports 9 programming languages and 14 frameworks, detecting over 55 vulnerability types through a dual-track audit model that combines sink-driven, control-driven, and config-driven detection strategies. The skill uses a multi-agent architecture to parallelize analysis across 10 security dimensions, from injection flaws to business logic vulnerabilities, and includes a reference library of 88,636 real-world vulnerability cases for pattern matching.
Key Features
Use Cases
- 01Perform comprehensive security audits of Spring Boot, Django, or other web application codebases
- 02Integrate automated vulnerability scanning into CI/CD pipelines using Quick mode
- 03Conduct deep penetration testing assessments on critical production applications
- 04Identify authorization gaps and business logic flaws through control-driven analysis
- 05Analyze dependency vulnerabilities and supply chain risks in multi-language projects
- 06Generate security reports with attack chain visualization for remediation prioritization
Related Skills
View moresuperpowers
An agentic skills framework & software development methodology that works.
skills
Skills for Real Engineers. Straight from my .agents directory.
skills
Public repository for Agent Skills
ponytail
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
code-audit — FAQ
What is the code-audit agent skill?+
Code Audit is a security analysis skill for Claude Code that performs static white-box code audits to discover vulnerabilities across 9 programming languages and 14 frameworks. It uses a multi-agent architecture to detect over 55 vulnerability types including SQL injection, RCE, deserialization flaws, and business logic issues.
How do I install the code-audit skill for Claude Code?+
Copy the code-audit directory into your Claude Code skills folder at ~/.claude/skills/. Once installed, the skill activates automatically when you request security audits using trigger phrases like 'audit this project' or '/code-audit'.
Which AI clients work with code-audit?+
This skill is designed specifically for Claude Code. It integrates directly into the Claude Code environment and activates through conversational triggers or slash commands.
Do I need API keys or prerequisites to use code-audit?+
No external API keys are required. The skill runs entirely within Claude Code and uses the agent's built-in code reading tools to analyze your source code locally.
Is code-audit free to use?+
Yes, code-audit is open source and released under the MIT License. You can use it freely for authorized security testing of codebases you have permission to audit.
What scan modes does code-audit offer?+
Code-audit provides three modes: Quick (for CI/CD and small projects focusing on high-risk vulnerabilities), Standard (for regular audits covering OWASP Top 10), and Deep (for critical projects with full coverage, attack chains, and 2-3 analysis rounds).
How do I install code-audit?+
Open the source repository on GitHub and follow its README. code-audit is a skill — MCP Agents Market links you directly to the official repo.
Is code-audit free?+
code-audit is an open-source project hosted on GitHub. Check the repository for its license and any usage requirements.