Audit source code for security vulnerabilities and generate risk-rated CWE reports.
npx skills add https://github.com/chenchunrun/onyx-soc --skill code-audit-chenchunrun
Please help me install this Agent Skill. Skill: code-audit Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/code-audit Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill code-audit-chenchunrun
静态分析源代码，识别安全漏洞，评估风险等级，生成包含 CWE 映射和修复建议的审计报告。
对指定代码库进行静态安全审计并输出带 CWE 映射的审计报告。
High-intent search queries and answers about installing and using this skill.
Static code security auditing scans source code to identify vulnerabilities. You can audit Python, Java, JavaScript, PHP, Go, and C/C++ projects by analyzing single files, directories, or entire Git repositories to produce risk-rated reports.
Yes, you can scan a Git repository for OWASP Top 10 vulnerabilities automatically. The automated scanning workflow identifies security flaws, maps them to CWE classifications, and generates remediation guidance for detected issues.
Generating a code audit report with CWE mappings requires an end-to-end workflow of code collection, automated scanning, and manual review. This produces risk-rated reports that include specific CWE mappings and actionable remediation guidance.
Static analysis supports Go and C/C++ legacy code compliance checks. It evaluates source code against OWASP Top 10 and CWE Top 25 standards, making it suitable for checking third-party dependencies and remaining compliant.
A manual review step in an automated SAST workflow validates findings from automated scanning. This end-to-end process ensures accurate risk rating and produces reliable CWE mappings and remediation guidance before final report generation.
igbuendPerform interprocedural static analysis with CodeQL to detect security vulnerabilities and generate SARIF output.
MAF2414Identifies and reports vulnerabilities in JWT-based authentication systems.
AlejandroFiginiAnalyze projects for security vulnerabilities and generate prioritized remediation reports.
voidrotConfigure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.
