code-audit-skill

中文 | English

中文

项目简介

code-audit-skill 是一个面向 AI 编程 Agent 的代码安全审计工作流，用于辅助完成企业应用代码审计、漏洞候选发现、动态验证、影响边界确认和报告级结果整理。

它适用于 OA、CMS、门户系统、工作流平台以及其他复杂企业业务系统。项目目标不是让 Agent 输出大量未经验证的可疑问题，而是通过多角色分工和静态 + 动态结合的审计流程，收敛出少量高置信、可复现、可写入报告的安全结论。

该工作流既可以作为 Claude Code Skill 使用，也可以被 Codex、Cursor、Cline、Roo Code、Gemini CLI 等其他 AI coding agent 复用为自定义审计提示词或工作流模板。

核心思想

传统 AI 代码审计容易出现两个问题：

只看静态代码，产生大量无法验证的猜测性 finding；
只做动态测试，缺少对真实代码路径、危险 sink 和业务上下文的理解。

code-audit-skill 的设计目标是把两者结合起来：

静态代码审计 -> 候选发现与优先级排序 -> Burp MCP / 运行时流量验证 -> 边界扩展 -> 报告输出

推荐搭配 Burp MCP 使用。静态审计负责发现高价值候选路径，Burp MCP 负责把候选放回真实 HTTP 请求、登录态、参数、回显和业务流程中验证，从而降低误报并提升漏洞结论的可信度。

对比传统代码审计 Skill 的优势

code-audit-skill 不是一个简单的“帮我找漏洞”提示词，而是一个面向复杂企业应用的 AI 安全审计工作流。

对比项	传统代码审计 Skill	code-audit-skill
工作方式	单一 prompt，直接让 Agent 找漏洞	多角色工作流，分阶段完成发现、验证、扩展和报告
审计主线	容易发散，输出很多零散问题	Orchestrator 控制范围、优先级和候选状态
静态分析	直接从代码中猜测漏洞	Mapper 建立目标画像、路由图、sink 图和候选池
动态验证	通常缺失，或依赖人工补充请求结果	Verifier 可结合 Burp MCP 进行真实请求验证
误报控制	容易把 suspicious code 当成 confirmed vulnerability	明确区分 possible、validated、confirmed finding
影响判断	常常推测最大影响	Boundary Tester 专门确认实际影响边界
报告输出	需要人工二次整理	Reporter 输出报告级描述、证据和下一步动作
适用目标	更适合小范围代码 review	更适合 OA、CMS、门户、工作流等复杂企业系统

本项目与其他审计 Skill 的区别

1. 多角色审计编排

本项目将一次复杂代码审计划分为五个角色：

Orchestrator：控制审计范围、主线、优先级和候选状态
Mapper：发现路由、输入点、权限边界、危险 sink 和反馈通道
Verifier：对高优先级候选进行最小化动态验证
Boundary Tester：确认已验证漏洞的真实影响范围
Reporter：生成报告级漏洞结论和证据描述

这种设计可以避免 Agent 在复杂项目中同时处理“发现、验证、扩大影响、写报告”，导致上下文混乱、重复分析和结论不稳定。

2. 静态 + 动态闭环

很多审计 prompt 停留在静态代码分析阶段。code-audit-skill 明确要求：

静态候选 != 已确认漏洞

只有经过运行时验证、请求响应证据和边界确认后，候选项才应该进入 confirmed finding。

3. Burp MCP 增强验证

当 Burp MCP 可用时，Agent 可以把静态候选映射到真实 HTTP 流量中：

从 Burp history 定位请求
复用 Cookie、Header、CSRF token 和真实登录态
修改参数并重放请求
对比响应差异、状态码、回显和错误信息
提取可复现请求与响应证据

这让代码审计不再停留在“看起来可能有问题”，而是更接近真实安全测试流程。

4. 候选状态管理

该 skill 推荐维护候选状态表：

candidate_id | priority | state | owner | next_action

候选可以处于：

possible
requires_more_context
validated
confirmed
disproved
deferred

这可以减少重复分析，让长时间、多模块审计任务保持清晰。

5. 面向报告收敛

最终目标不是输出最多 finding，而是输出最可靠的 finding：

少量高置信漏洞 > 大量低质量猜测

每个 confirmed finding 都应该能回答：

漏洞在哪里？
输入如何到达危险 sink？
如何动态验证？
实际影响边界是什么？
报告中应该如何描述？

核心能力

企业应用代码安全审计任务编排
路由、模块、入口点、权限边界、危险 sink 和反馈通道梳理
静态漏洞候选发现与过滤
候选项优先级排序，避免审计主线发散
结合 Burp MCP 进行动态请求验证、重放和证据提取
对已确认漏洞进行影响边界扩展
区分 possible finding、validated finding 和 confirmed finding
输出报告级漏洞描述、证据、影响范围和下一步动作
支持多角色协作式审计流程

推荐使用模式：静态审计 + Burp MCP 动态验证

该 skill 的最佳效果来自静态审计和动态验证的结合。

1. 静态审计阶段

AI Agent 首先阅读项目代码，建立目标画像：

业务模块和路由结构
Controller / API endpoint / handler
用户输入点
文件上传、下载、导入、导出功能
SQL / ORM / 查询构造路径
模板渲染、表达式执行、脚本执行路径
SSRF / callback / webhook / remote fetch 功能
权限校验、对象级访问控制和租户隔离逻辑
回显点、日志点、错误信息和可观测反馈通道

该阶段的产物不是“确认漏洞”，而是候选池：

candidate_pool
filtered_findings
prioritized_candidates

2. Burp MCP 动态验证阶段

当存在 Burp MCP 或类似 HTTP 运行时能力时，Agent 可以把静态候选映射到真实请求中验证：

从 Burp history 中定位相关请求
复用真实登录态、Cookie、Header 和 CSRF token
修改参数并重放请求
对比响应差异、状态码、回显、跳转和错误信息
验证权限绕过、对象越权、注入、文件访问、SSRF 等候选
保存可复现请求、响应片段和验证证据

该阶段用于回答：

这个静态候选是否真的可达？
是否需要认证？
是否受权限限制？
输入是否可控？
危险 sink 是否能被触发？
是否存在稳定反馈通道？

3. 边界扩展阶段

对已动态确认的问题继续确认实际影响边界：

低权限用户是否可触发
跨用户 / 跨部门 / 跨租户是否成立
只读、写入、删除、导出等能力边界
文件读取、路径穿越、上传后执行等影响范围
SSRF 可访问的协议、主机、端口和内网边界
注入类问题是否可从报错、布尔、时间、联合查询等方式扩大影响

该阶段的目标不是盲目扩大攻击面，而是明确漏洞报告中可以负责任描述的真实影响。

多角色工作流

该项目不是单一提示词，而是一个多角色审计流程。每个角色只负责一个清晰阶段，避免 Agent 在复杂审计中混淆“发现、验证、扩展、报告”的边界。

角色	文件	核心职责	主要输出
Orchestrator	`orchestrator_prompt.md`	控制审计范围、主线、优先级、候选状态和下一步动作	`current_scope`, `prioritized_candidates`, `candidate_state_table`, `next_best_actions`
Mapper	`mapper_prompt.md`	梳理代码结构、路由、输入点、危险 sink、权限边界和反馈通道	`target_profile`, `route_map`, `sink_map`, `candidate_pool`
Verifier	`verifier_prompt.md`	对 P1 候选做最小化动态验证，确认可达性、可控性和反馈链	`minimal_validation_results`, `validated_findings`, `disproved_candidates`
Boundary Tester	`boundary_tester_prompt.md`	对已验证漏洞做影响边界扩展，确认真实影响范围	`boundary_matrix_results`, `confirmed_findings`
Reporter	`reporter_prompt.md`	将确认结果整理成报告级表达	`final_report_outline`, `finding_summary`, `evidence_notes`

角色协作方式

推荐流程：

User Objective
    ↓
Orchestrator: 明确范围、主线和优先级
    ↓
Mapper: 建立目标画像，发现候选路径
    ↓
Orchestrator: 合并候选，筛选 P1/P2/P3
    ↓
Verifier: 使用运行时能力或 Burp MCP 验证 P1 候选
    ↓
Boundary Tester: 扩展已验证问题的实际影响边界
    ↓
Reporter: 输出报告级漏洞结论和证据

默认审计流程

明确审计范围与目标
建立目标画像
梳理路由、模块、输入点、权限边界和危险 sink
发现并过滤静态漏洞候选
对候选项进行 P1 / P2 / P3 优先级排序
使用 Burp MCP 或其他运行时方式对 P1 候选进行最小化动态验证
对已验证问题进行影响边界扩展
输出报告级结论、证据和下一步动作

候选优先级模型

建议从以下维度给候选排序：

维度	说明
controllability	用户输入是否可控，是否能影响危险参数
sink risk	sink 是否高危，例如 SQL、文件、模板、命令、SSRF、权限判断
auth barrier	是否低权限可达，是否需要管理员权限
feedback chain	是否存在响应、错误、时间、日志、状态变化等反馈
validation cost	是否能用少量请求快速验证

推荐分层：

P1: 立即验证，高影响、低成本、反馈链清晰
P2: 需要补充上下文后再验证
P3: 记录但暂缓，证据弱或验证成本高

输出目标

推荐将审计过程收敛为以下结构：

target_profile
route_map
sink_map
candidate_pool
filtered_findings
prioritized_candidates
minimal_validation_results
boundary_matrix_results
confirmed_findings
final_report_outline
next_best_actions

适用场景

本项目适合用于以下类型的安全审计任务：

OA / CMS / 门户 / 工作流系统代码审计
企业业务系统高危漏洞挖掘
上传、下载、导入、导出功能审计
SQL 注入、ORM 查询污染、表达式注入、模板注入分析
SSRF、webhook、callback、远程资源抓取功能审计
任意文件读取、路径穿越、文件覆盖、上传链路分析
访问控制、对象级权限、租户隔离和业务逻辑漏洞分析
从静态代码候选收敛到可验证漏洞结论
生成可用于安全报告的漏洞证据和结论

不适用场景

以下任务不需要完整使用该工作流：

单点 PoC 复现，不需要完整审计编排
纯源码格式检查或普通代码质量 review
没有代码、没有请求、也没有运行时反馈的纯猜测分析
只需要最终报告润色，不需要发现和验证过程

兼容性

该项目的核心是通用 AI Agent 审计工作流。任何支持自定义指令、提示词模块或 skill-style 工作流的 AI 编程 Agent 都可以复用其中的角色提示词和流程设计。

可用于：

Claude Code
Codex
Cursor
Cline
Roo Code
Gemini CLI
其他支持自定义工作流的 AI coding agents

Claude Code 用户可以直接将 code-audit/ 目录作为 skill 使用。其他 Agent 可以将其中的角色文件作为 prompt modules、custom instructions 或 workflow references 使用。

安装方式

Claude Code

将 code-audit/ 目录复制到 Claude Code skills 目录：

~/.claude/skills/code-audit/

安装后目录结构应为：

~/.claude/skills/code-audit/
├── SKILL.md
├── README.md
├── integration_with_code_security_review.md
├── orchestrator_prompt.md
├── mapper_prompt.md
├── verifier_prompt.md
├── boundary_tester_prompt.md
└── reporter_prompt.md

调用示例：

/code-audit 审计当前项目，优先找高危、可动态验证、可形成报告的漏洞。若可用，请结合 Burp MCP 对 P1 候选进行动态验证。

其他 AI Agent

其他 Agent 可以直接读取并复用 code-audit/ 目录下的角色文件：

code-audit/
├── SKILL.md
├── README.md
├── integration_with_code_security_review.md
├── orchestrator_prompt.md
├── mapper_prompt.md
├── verifier_prompt.md
├── boundary_tester_prompt.md
└── reporter_prompt.md

建议使用方式：

将 orchestrator_prompt.md 作为主控审计流程
使用 mapper_prompt.md 进行静态映射和候选发现
使用 verifier_prompt.md 进行最小化动态验证
使用 boundary_tester_prompt.md 扩展已确认漏洞边界
使用 reporter_prompt.md 生成最终报告级输出

与 Burp MCP 的关系

Burp MCP 不是该项目的必需依赖，但它是推荐的动态验证增强组件。

没有 Burp MCP 时，该工作流仍然可以完成静态审计、候选排序和报告整理。有 Burp MCP 时，Agent 可以直接利用真实 HTTP 流量进行验证，整体效果更好：

能力	无 Burp MCP	有 Burp MCP
静态代码路径发现	支持	支持
候选优先级排序	支持	支持
真实请求定位	需要人工提供	可从 Burp history 辅助定位
登录态复用	需要人工提供	可复用 Burp 中的 Cookie / Header
参数重放验证	手动构造	可基于真实请求修改重放
响应差异分析	依赖人工反馈	可结合响应内容直接分析
报告证据提取	支持	更完整

设计原则

静态候选不等于已确认漏洞
动态验证结果优先于静态推测
未经验证的利用链不写成确定影响
优先验证高影响、低权限、反馈链清晰的候选项
保持主线收敛，避免同时展开过多分支
用请求、响应、代码路径和运行时证据支撑最终结论
输出少量高置信 finding，而不是大量低质量猜测

仓库结构

code-audit-skill/
├── README.md
├── LICENSE
├── .gitignore
└── code-audit/
    ├── SKILL.md
    ├── README.md
    ├── integration_with_code_security_review.md
    ├── orchestrator_prompt.md
    ├── mapper_prompt.md
    ├── verifier_prompt.md
    ├── boundary_tester_prompt.md
    └── reporter_prompt.md

关键词

code audit, security audit, vulnerability discovery, AI agent skill,
static analysis, runtime validation, dynamic validation, Burp MCP,
application security, enterprise security, AI security audit,
代码审计, 代码安全审计, 漏洞审计, 动态验证, AI安全审计

English

Overview

code-audit-skill is a code security audit workflow for AI coding agents. It helps agents perform enterprise application code audits, vulnerability candidate discovery, runtime validation, impact boundary analysis, and report-ready finding preparation.

It is designed for OA systems, CMS platforms, portals, workflow systems, and other complex enterprise applications. The goal is not to make agents produce a large list of unverified suspicious issues, but to converge on a small number of high-confidence, reproducible, evidence-backed security findings through a multi-role workflow and a static + dynamic audit model.

The workflow can be used as a Claude Code Skill, and it can also be reused by Codex, Cursor, Cline, Roo Code, Gemini CLI, and other AI coding agents as custom audit prompts or workflow templates.

Core Idea

AI-assisted code audit often suffers from two problems:

Static-only review produces many speculative findings that are never validated.
Dynamic-only testing lacks source-level understanding of real execution paths, dangerous sinks, and business context.

code-audit-skill is designed to combine both sides:

Static code audit -> Candidate discovery and prioritization -> Burp MCP / runtime traffic validation -> Boundary expansion -> Report output

Burp MCP is a recommended companion. Static review identifies high-value candidate paths, while Burp MCP helps validate those candidates against real HTTP requests, sessions, parameters, responses, and business flows. This reduces false positives and improves the reliability of final findings.

Advantages over Traditional Code Audit Skills

code-audit-skill is not a simple “find vulnerabilities for me” prompt. It is an AI security audit workflow designed for complex enterprise applications.

Area	Traditional code audit skill	code-audit-skill
Working model	Single prompt that asks the agent to find vulnerabilities	Multi-role workflow for discovery, validation, boundary analysis, and reporting
Audit focus	Easily diverges into many isolated issues	Orchestrator controls scope, priority, and candidate state
Static analysis	Often guesses vulnerabilities directly from code	Mapper builds a target profile, route map, sink map, and candidate pool
Dynamic validation	Often missing or depends on manual request feedback	Verifier can use Burp MCP to validate candidates against real requests
False positive control	May treat suspicious code as confirmed vulnerability	Separates possible, validated, and confirmed findings
Impact assessment	Often assumes maximum impact	Boundary Tester confirms practical impact boundaries
Reporting	Usually requires manual rewriting	Reporter produces report-ready descriptions, evidence, and next actions
Best fit	Small code review tasks	OA, CMS, portal, workflow, and complex enterprise systems

How This Project Differs from Other Audit Skills

1. Multi-role audit orchestration

This project divides a complex audit into five roles:

Orchestrator: controls scope, main line, priority, and candidate state
Mapper: discovers routes, input points, authorization boundaries, dangerous sinks, and feedback channels
Verifier: performs minimal dynamic validation for high-priority candidates
Boundary Tester: confirms the real impact boundaries of validated findings
Reporter: generates report-ready vulnerability conclusions and evidence descriptions

This prevents the agent from mixing discovery, validation, impact expansion, and reporting in one unstable reasoning thread.

2. Static + dynamic validation loop

Many audit prompts stop at static code analysis. code-audit-skill makes this rule explicit:

Static candidate != confirmed vulnerability

A candidate should only become a confirmed finding after runtime validation, request/response evidence, and boundary confirmation.

3. Burp MCP enhanced validation

When Burp MCP is available, the agent can map static candidates back to real HTTP traffic:

Locate requests from Burp history
Reuse cookies, headers, CSRF tokens, and real sessions
Modify parameters and replay requests
Compare response differences, status codes, reflections, and errors
Extract reproducible request and response evidence

This moves the audit from “this code looks suspicious” toward a real security testing workflow.

4. Candidate state management

The skill encourages maintaining a candidate state table:

candidate_id | priority | state | owner | next_action

Candidates can move through states such as:

possible
requires_more_context
validated
confirmed
disproved
deferred

This reduces repeated analysis and keeps long, multi-module audits organized.

5. Report-oriented convergence

The final goal is not to produce the most findings. The goal is to produce the most reliable findings:

A small number of high-confidence findings > many low-quality guesses

Each confirmed finding should answer:

Where is the vulnerability?
How does input reach the dangerous sink?
How was it dynamically validated?
What is the practical impact boundary?
How should it be described in a report?

Core Capabilities

Enterprise application security audit orchestration
Mapping of routes, modules, entry points, authorization boundaries, dangerous sinks, and feedback channels
Static vulnerability candidate discovery and filtering
Candidate prioritization to keep the audit focused
Dynamic request validation, replay, and evidence extraction with Burp MCP
Boundary expansion for confirmed findings
Separation between possible findings, validated findings, and confirmed findings
Report-ready vulnerability wording, evidence, impact, and next actions
Multi-role audit workflow support

Recommended Mode: Static Audit + Burp MCP Dynamic Validation

This skill works best when static audit and dynamic validation are combined.

1. Static Audit Stage

The AI agent first reads the codebase and builds a target profile:

Business modules and route structure
Controllers, API endpoints, and handlers
User input points
Upload, download, import, and export features
SQL, ORM, and query construction paths
Template rendering, expression evaluation, and script execution paths
SSRF, callback, webhook, and remote fetch features
Authorization checks, object-level access control, and tenant isolation logic
Response points, logs, errors, and observable feedback channels

The output of this stage is not a confirmed vulnerability. It is a candidate pool:

candidate_pool
filtered_findings
prioritized_candidates

2. Burp MCP Dynamic Validation Stage

When Burp MCP or similar HTTP runtime capability is available, the agent can map static candidates back to real requests:

Locate relevant requests from Burp history
Reuse real sessions, cookies, headers, and CSRF tokens
Modify parameters and replay requests
Compare response differences, status codes, reflections, redirects, and errors
Validate candidates such as authorization bypass, IDOR, injection, file access, and SSRF
Preserve reproducible requests, response snippets, and validation evidence

This stage answers:

Is the static candidate reachable at runtime?
Is authentication required?
Is it blocked by authorization checks?
Is the input controllable?
Can the dangerous sink be triggered?
Is there a stable feedback channel?

3. Boundary Expansion Stage

For dynamically validated issues, the workflow then determines practical impact boundaries:

Whether low-privilege users can trigger the issue
Whether cross-user, cross-department, or cross-tenant impact exists
Read, write, delete, export, or execution boundaries
File read, path traversal, overwrite, and upload-chain impact
SSRF protocol, host, port, and internal network boundaries
Whether injection impact can be expanded through error-based, boolean-based, time-based, or union-based techniques

The goal is not uncontrolled expansion. The goal is to define what can be responsibly claimed in the final report.

Multi-Role Workflow

This project is not a single prompt. It is a multi-role audit workflow. Each role owns a clear stage so that the agent does not confuse discovery, validation, boundary analysis, and reporting.

Role	File	Core Responsibility	Main Outputs
Orchestrator	`orchestrator_prompt.md`	Controls scope, main line, priorities, candidate state, and next actions	`current_scope`, `prioritized_candidates`, `candidate_state_table`, `next_best_actions`
Mapper	`mapper_prompt.md`	Maps code structure, routes, input points, dangerous sinks, authorization boundaries, and feedback channels	`target_profile`, `route_map`, `sink_map`, `candidate_pool`
Verifier	`verifier_prompt.md`	Performs minimal dynamic validation for P1 candidates, confirming reachability, controllability, and feedback chains	`minimal_validation_results`, `validated_findings`, `disproved_candidates`
Boundary Tester	`boundary_tester_prompt.md`	Expands the impact boundaries of validated findings	`boundary_matrix_results`, `confirmed_findings`
Reporter	`reporter_prompt.md`	Converts confirmed results into report-ready wording	`final_report_outline`, `finding_summary`, `evidence_notes`

Role Collaboration Flow

Recommended flow:

User Objective
    ↓
Orchestrator: define scope, main line, and priorities
    ↓
Mapper: build target profile and discover candidate paths
    ↓
Orchestrator: merge candidates and classify P1/P2/P3
    ↓
Verifier: validate P1 candidates with runtime capability or Burp MCP
    ↓
Boundary Tester: expand practical impact boundaries for validated issues
    ↓
Reporter: produce report-ready findings and evidence

Default Audit Flow

Define audit scope and objective
Build the target profile
Map routes, modules, input points, authorization boundaries, and dangerous sinks
Discover and filter static vulnerability candidates
Prioritize candidates into P1 / P2 / P3
Use Burp MCP or another runtime method to minimally validate P1 candidates
Expand practical impact boundaries for validated issues
Produce report-ready conclusions, evidence, and next actions

Candidate Prioritization Model

Candidates should be ranked using these dimensions:

Dimension	Meaning
controllability	Whether user input can control the dangerous parameter
sink risk	Whether the sink is high risk, such as SQL, file, template, command, SSRF, or authorization logic
auth barrier	Whether the path is reachable by low-privilege users or requires admin access
feedback chain	Whether response, error, timing, logs, or state changes provide observable feedback
validation cost	Whether the candidate can be validated with a small number of requests

Recommended tiers:

P1: Validate immediately; high impact, low cost, clear feedback chain
P2: Needs more context before validation
P3: Record and defer; weak evidence or high validation cost

Expected Outputs

The audit should converge toward structured outputs such as:

target_profile
route_map
sink_map
candidate_pool
filtered_findings
prioritized_candidates
minimal_validation_results
boundary_matrix_results
confirmed_findings
final_report_outline
next_best_actions

Use Cases

This project is suitable for security audit tasks such as:

OA, CMS, portal, and workflow system code audits
High-impact vulnerability discovery in enterprise applications
Upload, download, import, and export feature review
SQL injection, ORM query pollution, expression injection, and template injection analysis
SSRF, webhook, callback, and remote resource fetching review
Arbitrary file read, path traversal, file overwrite, and upload-chain analysis
Access control, object-level authorization, tenant isolation, and business logic vulnerability analysis
Converging from static candidates to verified vulnerability conclusions
Preparing evidence-backed findings for security reports

Non-Goals

The full workflow is not necessary for:

Single PoC reproduction that does not need audit orchestration
Pure formatting checks or general code quality review
Pure speculation without code, requests, or runtime feedback
Final report polishing only, without discovery or validation

Compatibility

The core of this project is an agent-agnostic AI audit workflow. Any AI coding agent that supports custom instructions, prompt modules, or skill-style workflows can reuse the role prompts and process design.

It can be used with:

Claude Code
Codex
Cursor
Cline
Roo Code
Gemini CLI
Other AI coding agents with custom workflow support

Claude Code users can install the code-audit/ directory directly as a skill. Other agents can reuse the role files as prompt modules, custom instructions, or workflow references.

Installation

Claude Code

Copy the code-audit/ directory into your Claude Code skills directory:

~/.claude/skills/code-audit/

After installation, the directory should look like this:

~/.claude/skills/code-audit/
├── SKILL.md
├── README.md
├── integration_with_code_security_review.md
├── orchestrator_prompt.md
├── mapper_prompt.md
├── verifier_prompt.md
├── boundary_tester_prompt.md
└── reporter_prompt.md

Usage example:

/code-audit Audit the current project for high-impact vulnerabilities that can be dynamically validated and reported. If available, use Burp MCP to validate P1 candidates.

Other AI Agents

Other agents can directly read and reuse the role files under code-audit/:

code-audit/
├── SKILL.md
├── README.md
├── integration_with_code_security_review.md
├── orchestrator_prompt.md
├── mapper_prompt.md
├── verifier_prompt.md
├── boundary_tester_prompt.md
└── reporter_prompt.md

Recommended usage:

Use orchestrator_prompt.md as the top-level audit controller
Use mapper_prompt.md for static mapping and candidate discovery
Use verifier_prompt.md for minimal runtime validation
Use boundary_tester_prompt.md to expand confirmed vulnerability boundaries
Use reporter_prompt.md to produce final report-ready output

Relationship with Burp MCP

Burp MCP is not a hard dependency, but it is the recommended dynamic validation companion.

Without Burp MCP, the workflow can still perform static review, candidate prioritization, and report organization. With Burp MCP, the agent can validate candidates against real HTTP traffic, which usually produces stronger results:

Capability	Without Burp MCP	With Burp MCP
Static code path discovery	Supported	Supported
Candidate prioritization	Supported	Supported
Real request location	Requires manual input	Can use Burp history
Session reuse	Requires manual input	Can reuse cookies and headers from Burp
Parameter replay validation	Manually constructed	Based on real requests
Response difference analysis	Depends on manual feedback	Can analyze response content directly
Report evidence extraction	Supported	More complete

Design Principles

Static candidates are not confirmed vulnerabilities
Runtime validation has higher priority than static speculation
Unverified exploit chains should not be described as confirmed impact
Prioritize candidates with high impact, low privilege requirements, and clear feedback channels
Keep the audit main line narrow and convergent
Support final conclusions with requests, responses, code paths, and runtime evidence
Prefer a small number of high-confidence findings over many low-quality guesses

Repository Structure

code-audit-skill/
├── README.md
├── LICENSE
├── .gitignore
└── code-audit/
    ├── SKILL.md
    ├── README.md
    ├── integration_with_code_security_review.md
    ├── orchestrator_prompt.md
    ├── mapper_prompt.md
    ├── verifier_prompt.md
    ├── boundary_tester_prompt.md
    └── reporter_prompt.md

Keywords

code audit, security audit, vulnerability discovery, AI agent skill,
static analysis, runtime validation, dynamic validation, Burp MCP,
application security, enterprise security, AI security audit,
代码审计, 代码安全审计, 漏洞审计, 动态验证, AI安全审计

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
code-audit		code-audit
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation

code-audit-skill

中文

项目简介

核心思想

对比传统代码审计 Skill 的优势

本项目与其他审计 Skill 的区别

1. 多角色审计编排

2. 静态 + 动态闭环

3. Burp MCP 增强验证

4. 候选状态管理

5. 面向报告收敛

核心能力

推荐使用模式：静态审计 + Burp MCP 动态验证

1. 静态审计阶段

2. Burp MCP 动态验证阶段

3. 边界扩展阶段

多角色工作流

角色协作方式

默认审计流程

候选优先级模型

输出目标

适用场景

不适用场景

兼容性

安装方式

Claude Code

其他 AI Agent

与 Burp MCP 的关系

设计原则

仓库结构

关键词

English

Overview

Core Idea

Advantages over Traditional Code Audit Skills

How This Project Differs from Other Audit Skills

1. Multi-role audit orchestration

2. Static + dynamic validation loop

3. Burp MCP enhanced validation

4. Candidate state management

5. Report-oriented convergence

Core Capabilities

Recommended Mode: Static Audit + Burp MCP Dynamic Validation

1. Static Audit Stage

2. Burp MCP Dynamic Validation Stage

3. Boundary Expansion Stage

Multi-Role Workflow

Role Collaboration Flow

Default Audit Flow

Candidate Prioritization Model

Expected Outputs

Use Cases

Non-Goals

Compatibility

Installation

Claude Code

Other AI Agents

Relationship with Burp MCP

Design Principles

Repository Structure

Keywords

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Packages