audit-skills

Why we included this project

Code audits run through AI agents tend to go off the rails unless you constrain what the model looks at. This skill pack does that constraining for you: drop it into the .skills directory of Claude Code or Codex, then ask specific questions, one vulnerability type at a time, such as SQL injection or insecure deserialization. It ships with Java and .NET reference material covering decompilation, deobfuscation, and component scanning for vulnerable dependencies, and it forces findings into a fixed report shape, so each one carries the file path, line number, reachable path, trigger condition, and a recommended fix instead of free-form commentary. A documented Codex orchestration workflow splits the job into per-vulnerability passes, has one reviewer merge and dedupe the results, and keeps everything read-only. The payoff is an audit you can rerun and hand to a team without drowning in noise.