code-audit

Name: code-audit
Availability: InStock
Author: chenchunrun

Audit source code for security vulnerabilities and generate risk-rated CWE reports.

1|1|Updated Apr 25, 2026

Search Tags:#OWASP #security #vulnerability #static-analysis #SAST #code-audit #CWE

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill code-audit-chenchunrun

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: code-audit
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/code-audit
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill code-audit-chenchunrun

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

静态分析源代码，识别安全漏洞，评估风险等级，生成包含 CWE 映射和修复建议的审计报告。

Core Features & Use Cases

支持 Python、Java、JavaScript/TypeScript、PHP、Go、C/C++ 等主流语言；覆盖 OWASP Top 10 与 CWE Top 25 的常见漏洞。
提供从代码收集、自动化扫描、人工复核到报告生成的端到端工作流，帮助团队在开发周期中及早发现并修复安全问题。
适用于新代码提交前的安全审计、第三方依赖与遗留代码的合规性检查，以及生成可执行的修复建议的审计报告。

Quick Start

对指定代码库进行静态安全审计并输出带 CWE 映射的审计报告。

Frequently Asked Questions about code-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform static code security auditing on a Python or Java repository?▼

Static code security auditing scans source code to identify vulnerabilities. You can audit Python, Java, JavaScript, PHP, Go, and C/C++ projects by analyzing single files, directories, or entire Git repositories to produce risk-rated reports.

Can I scan a Git repository for OWASP Top 10 vulnerabilities automatically?▼

Yes, you can scan a Git repository for OWASP Top 10 vulnerabilities automatically. The automated scanning workflow identifies security flaws, maps them to CWE classifications, and generates remediation guidance for detected issues.

What is the best way to generate a code audit report with CWE mappings and remediation guidance?▼

Generating a code audit report with CWE mappings requires an end-to-end workflow of code collection, automated scanning, and manual review. This produces risk-rated reports that include specific CWE mappings and actionable remediation guidance.

Does static analysis support Go and C/C++ legacy code compliance checks?▼

Static analysis supports Go and C/C++ legacy code compliance checks. It evaluates source code against OWASP Top 10 and CWE Top 25 standards, making it suitable for checking third-party dependencies and remaining compliant.

Why include a manual review step in an automated SAST workflow?▼

A manual review step in an automated SAST workflow validates findings from automated scanning. This end-to-end process ensures accurate risk rating and produces reliable CWE mappings and remediation guidance before final report generation.