Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Laolaoshiren/Security Audit — measured AI agent skill | DecimalAI

laolaoshiren/security-audit

SkillScore50Maintained

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

Securityby laolaoshiren

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/laolaoshiren-security-audit/SKILL.md

decimalai skills pull laolaoshiren-security-audit --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/laolaoshiren-security-audit/SKILL.md https://app.decimal.ai/s/laolaoshiren-security-audit/SKILL.md

Raw file: /s/laolaoshiren-security-audit/SKILL.md ↗ · machine-readable summary at /s/laolaoshiren-security-audit.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 4h ago

Yes — +5% lift+13% tokens0% turns50% of whole cases pass with skill (11/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✓	▲ Improved	-14%	0%
case-04	✓→✓	＝ Same ✓	25%	0%
case-05	✓→✓	＝ Same ✓	-6%	0%
case-06	✓→✓	＝ Same ✓	87%	0%
case-07	✓→✓	＝ Same ✓	11%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

laolaoshiren / claude-code-skills-zh

skills/security-audit/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

代码安全审计

触发条件

当用户要求安全检查、漏洞扫描、安全审计、依赖安全检查时激活此技能。

工作流程

确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
静态安全扫描 — 按检查清单逐项排查
依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
生成审计报告 — 按严重程度分类输出

检查清单

🔴 高危

] 硬编码密钥/密码/API Key
] SQL 注入风险（字符串拼接 SQL）
] 命令注入（未过滤的 shell 命令）
] 路径遍历（未校验的文件路径）
] 反序列化漏洞
] 未校验的 JWT/Token 验证

🟡 中危

] XSS 风险（未转义的用户输入）
] CSRF 保护缺失
] 不安全的随机数生成
] 敏感信息日志泄露
] 过宽的权限设置
] 缺少 Rate Limiting

🟢 低危

] 缺少输入验证
] 依赖版本过旧
] 缺少安全头部（CSP, HSTS, X-Frame-Options）
] 错误信息泄露内部细节
] 缺少 HTTPS 强制

输出格式

markdown
## 🔒 安全审计报告

### 审计概览
- 审计范围：xxx
- 发现问题：🔴 高危 X 个 / 🟡 中危 X 个 / 🟢 低危 X 个

### 🔴 高危问题
#### 1. [文件路径:行号]
- **漏洞类型**：xxx
- **风险描述**：xxx
- **攻击场景**：攻击者可以通过 xxx 方式...
- **修复方案**：
  ```code
  // 修复前
  // 修复后
  ```

### 🟡 中危问题
...

### 🟢 低危问题
...

### 依赖安全
| 依赖名 | 当前版本 | 建议版本 | 风险 |
|--------|---------|---------|------|

### 修复优先级建议
1. 立即修复：...
2. 本周修复：...
3. 长期改进：...

注意事项

提供修复前后的代码对比
对于每条漏洞，说明具体的攻击向量
优先级基于可利用性和影响范围判断

Want to see if laolaoshiren/security-audit would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.