dfyx Code Security Audit Skill

Skill by ara.so — Security Skills collection.

Expert-level code security auditing using white-box static analysis methodology through a five-phase standardized audit protocol. Designed by the EastSword team (东方隐侠团队) for systematic discovery and validation of security vulnerabilities in source code.

What This Skill Does

dfyx_code_security_review provides AI-powered security auditing with:

• Multi-language support: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust
• 10 security dimensions: Injection, Authentication, Authorization, Deserialization, File Operations, SSRF, Cryptography, Configuration, Business Logic, Supply Chain
• Three-track audit model:
  • Sink-driven (injection/RCE)
  • Control-driven (authorization/business logic)
  • Config-driven (configuration/crypto)
• Five-phase protocol: Reconnaissance → Pattern Matching → Taint Tracking → Validation → Reporting
• Real-world case library: Based on WooYun vulnerability cases (2010-2016)