Audit Codebase

Audit a codebase for security vulnerabilities by first mapping its attack surface (reconnaissance), then spawning specialized parallel sub-agents that hunt for specific vulnerability classes, each armed with the matching reference file bundled in this skill. Use this whenever the user wants a security review, a vulnerability scan, an audit, a pentest-style pass, or asks "is this code safe / exploitable", "check X for vulnerabilities", "review the auth", or points at a repo, service, or directory and asks what could go wrong. Trigger even when the user names only a stack ("audit my Django API")

6 starsSoftware Development

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add bogenc/audit-codebase --skill audit-codebase

Manual install

git clone --depth 1 https://github.com/bogenc/audit-codebase.git /tmp/audit-codebase
mkdir -p ~/.claude/skills
cp -r /tmp/audit-codebase/. ~/.claude/skills/audit-codebase

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

Security audits fail in two opposite ways: a shallow grep that pattern-matches `eval(` and calls it a day, or an undirected "look for everything" pass that spreads attention so thin it finds nothing real. This skill avoids both by working the way a competent auditor does — **look before you dig**.

1. **Reconnaissance** — map what the target actually exposes (entry points, trust boundaries, framework, data stores, auth model) so the search is aimed, not sprayed.
2. **Targeted specialists** — spawn **parallel sub-agents**, each responsible for a cluster of related vulnerability classes, but *only* for the classes the reconnaissance made plausible. Each specialist reads the deep-dive reference file bundled in this skill for its classes before touching code.
3. **Aggregate & triage** — collect every finding into one severity-ranked report the user can act on.

Recon runs in the main context; specialists run isolated so a huge SQL-injection reference doesn't crowd out the XSS hunter's context and vice-versa.

## What's bundled in this skill

Three reference directories sit next to this file. **Do not read them all up front** — reconnaissance decides which few are relevant, and only those get loaded (by you for the stack files, by the sub-agents for their vuln files). Read a file with `view`/`cat` at the path shown.

**`frameworks/`** — framework-specific sinks, sources, and safe/unsafe patterns:
`django.md`, `fastapi.md`, `nestjs.md`, `nextjs.md`

Read the full skill on GitHub

Details

Skill name: audit-codebase
Repository: bogenc/audit-codebase
License: Apache-2.0
Repo updated: 11 July 2026

FAQ

What does the Audit Codebase skill do?

How do I install the Audit Codebase skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add bogenc/audit-codebase --skill audit-codebase. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Audit Codebase popular?

It lives in bogenc/audit-codebase, which has 6 GitHub stars and 0 forks.

Related skills

Code Animations

beriki770-ship-it/code-animations

Make "code-rendered" animated videos where a program draws every frame (Canvas 2D + procedural Web Audio), rendered headless to MP4 in 16:9 / 9:16 / 4:5 from one timeline. Use for animated explainers, technical walkthroughs, diagrams in motion, and procedural sound or music, where the output should be editable code and not generated pixels.

Software Development

Affiliate Check

Gingg7260/affiliate-skills

Live affiliate program data from list.affitor.com. Search programs, compare commissions, check cookie days, find top performers. Use when researching affiliate programs, comparing options, or checking program details. Persistent daemon with cache — first call starts server (~2s), subsequent calls ~100ms.

Software Development

Code Forge

tercel/code-forge

Complete Codex development workflow for turning requirements, feature docs, or prompts into working code. Use when the user asks to plan implementation work, execute tasks, enforce TDD, review source code, fix bugs, debug failures, verify completion, manage worktrees or branch finishing, dispatch parallel agents, port a project to another language, check progress, or run an end-to-end build flow. Supports complex orchestration across plan -> impl -> review -> fix -> verify, plus build, forge smart dispatch, worktree, finish, parallel, port, tdd, debug, and status workflows. Every workflow here

Software Development

Xsoar Pack Dev

mdrobniu/xsoar-pack-dev-skill

Cortex XSOAR content pack development lifecycle - create packs, integrations, scripts, playbooks, run demisto-sdk lint/validate/pre-commit, build zip packs, manage versions and release notes, run unit tests, deploy to XSOAR instances, manage git branches/tags, handle marketplace vs local pack workflows. Use when the user wants to develop, test, build, validate, deploy, or manage XSOAR content packs.

Software Development

Codesplain

opitaru-sys/codesplain

Use when working in a coding project owned by a non-coder - when the project root contains CODESPLAIN.md, when the user invokes /codesplain (to bootstrap a project or ask a question), when a consequential technical decision comes up during building, or when explaining a bug or fix to the owner in plain language.

Software Development

Roast

janderswag/roast-skill

The free Roast & Rebuild Claude Code skill. Runs a 6-module audit on the current local repository — Roast, Security, Architecture, Customer Flow, Growth, Founder Briefing. Every finding cites file:line evidence. Same opinionated voice as the paid $19 audit at roastrebuild.com. Use when: "roast my repo", "audit this", "what's wrong with my code", "security check", "what should I fix next".

Software Development

Browse the most popular Claude skills, all software development skills, or write your own with the skills generator.