security-code-audit - A Codex skill for deep defensive security code aud

项目说明

Security Code Audit

security-code-audit is a Codex skill for deep, e security review of software repositories, pull requests, services, scripts, applications, infrastructure, and configuration.

It is built to push Codex beyond shallow scanner-style output: map the codebase first, identify trust boundaries, threat model the system, trace source-to-sink flows, claims, and report only issues grounded in concrete code e.

Repository: github.com/AKMessi/security-code-audit

Highlights

Use Cases

Use this skill when you want Codex to:

Safety

This skill is intended for authorized defensi work.

It instructs Codex to:

Installation

Clone this repository into your Codex skills directory.

Windows PowerShell

macOS or Linux

Restart Codex or start a new Codex session after installation so the skill metadata is loaded.

Usage

Invoke the skill explicitly with $security-code-audit.

How The Skill Works

The core workflow in SKILL.md asks Codex to:

1. Establish the review scope.
2. Build a code and trust-boundary map.
3. Create a lightweight threat model.
4. Trace source-to-sink and pri flows.
5. Check relevant classes systematically.
6. claims with code e, local tests, or safe tooling.
7. Report findings with se, confidence, attack path, impact, and fix guidance.

The reference files provide deeper guidance only when needed, keeping the main skill concise while still supporting serious reviews.

Included Files

Helper Script

The bundled helper script creates a first-pass security in for a repository:

JSON output:

It identifies:

The script intentionally omits line contents so likely secrets are not printed to the terminal. Treat its output as review leads, not confirmed findings.

If you have the Codex skill-creator system skill installed, the skill with:

Windows PowerShell

macOS or Linux

Expected result:

Check the helper script:

Publishing Checklist

Before publishing this repository publicly:

Contributing

Contributions are welcome when they impro security review quality, reduce false positives, impro requirements, or broaden framework and co.

Good contributions include:

Please keep the skill focused on authorized defensi. Do not add offensi workflows, credential misuse instructions, persistence, e, or li attack playbooks.

Security Reports

If you find a security issue in this skill or its helper script, report it through GitHub's private reporting if the repository has it enabled. If not, open a minimal issue that does not disclose sensiti details and ask the maintainer for a private reporting channel.

License

This project is licensed under the MIT License. See LICENSE for details.

项目信息

开发语言：Python

Star 数：5

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Codex skill for deep defensive security code audits, threat modeling, source-to-sink tracing, vulnerability triage, and evidence-first findings.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。