What problem does it solve? Manually reviewing large codebases for security flaws is slow and error-prone. This Skill systematizes source code security auditing by using grep-based pattern matching to locate dangerous function calls, sensitive data flows, and known vulnerability patterns across a project. ## Core Features & Use Cases - Multi-language vulnerability detection: Covers 30+ CWE types including SQL injection, command injection, XSS, SSRF, path traversal, deserialization, XXE, and SSTI across Java, Golang, PHP, Python, C/C++, and JavaScript. - Phased audit workflow: Scans by vulnerability category, then verifies each hit by reading surrounding code context to check for input filtering, parameterized queries, and escaping. - Configuration and crypto checks: Detects hardcoded credentials, weak algorithms (MD5, DES, ECB), insecure TLS settings, and risky CORS/Cookie configurations. - Use Case: Point the Skill at a legacy PHP project to find all mysql_query calls with concatenated user input, verify each finding in context, and produce a severity-ranked audit report with remediation advice. ## Quick Start Audit the project at /path/to/project for security vulnerabilities and write a severity-ranked report of all confirmed findings.
