A zero-API static vulnerability scanner that analyzes codebases across multiple programming languages to detect and repair ReDoS and regex quality defects.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install phy-regex-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install phy-regex-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Regex Audit?
The Regex Audit skill provides developers with a local, zero-external-API static analysis pipeline engineered specifically to uncover Regular Expression Denial of Service (ReDoS) hazards and structural regex deficiencies. By sweeping through a target project directory, the skill isolates matching patterns inside source files, exposes performance bottle-necks, and categorizes vulnerabilities based on their engineering risk levels.
Built to fortify production applications against catastrophic backtracking, this tool identifies highly specific anti-patterns such as nested quantifiers and overlapping alternations. Beyond vulnerability identification, it maps dangerous call sites inside high-risk components—like HTTP controllers and inbound payload schemas—and offers safe, optimized code rewrites to eliminate computational exhaustion vectors before they hit production environments.
Regex Audit Use Cases
- Scanning legacy software codebases to identify and eliminate silent ReDoS vectors prior to major version deployments.
- Auditing public-facing HTTP endpoint controllers, string sanitizers, and routing expressions for unanchored validation regex patterns.
- Enforcing secure coding guidelines locally or within integrated deployment pipelines by screening character classes for locale or ASCII limitations.
- Verifying the mathematical safety of customized email, telephone, or URL input pattern filters before pushing changes to production engines.
How Regex Audit Works
- Discovers target language source files within the workspace directory while intentionally bypassing non-production dependencies like node_modules, build artifacts, or package virtual environments.
- Extracts regular expression literals, instantiation blocks, and inline matching methods using language-specific syntax definitions for JavaScript, Python, Go, Java, Ruby, PHP, and Rust.
- Checks the context surrounding every extracted regular expression to discover if the statement lives within public request handlers or payload validation routines.
- Audits the regex strings against deterministic signature blocks configured to detect exponential quantifiers, polynomial overlapping alternations, greedy dot-star chains, or unanchored boundaries.
- Rates vulnerabilities by severity metrics ranging from low-priority locale anomalies to critical exponential backtracking conditions.
- Produces a highly prioritized security report containing targeted file pathways, precise line coordinate positions, conceptual attack vectors, and optimized alternative patterns.
Regex Audit Setup
Execute the following workspace commands to kickstart a local scanner loop or audit targeted path files directly:
# Audit the current working directory to auto-detect and review all source files
/regex-audit
# Scan specific internal directories or focused application validation files
/regex-audit src/
/regex-audit lib/validators.js
# Isolate the evaluation process to a specific development framework language
/regex-audit --lang js
/regex-audit --lang python
# Restrict findings to high-priority issues that represent security hazards
/regex-audit --min-severity high
/regex-audit --high-risk-only
Regex Audit Data Schema & Taxonomy
The evaluation output organizes discoveries using clear data taxonomies. Results can be marshaled into structured tables or exported into serialized schemas for automation integrations:
Severity Schema Classification
| Severity Level | Structural Matching Criteria | Runtime Operational Impact |
|---|---|---|
| CRITICAL | Nested quantifiers or star/plus combinations | Triggers exponential backtracking; proven denial of service hazard. |
| HIGH | Overlapping alternations or unanchored greedy dot-star loops | Triggers polynomial backtracking; impacts service responsiveness. |
| MEDIUM | Unbounded complex grouping sequences or unanchored constraints | Potential logic flaws; exposes applications to parsing bypasses. |
| LOW | Character class sets restricted to basic ASCII profiles | Functional localization limitations; string parsing quality defects. |
Extracted Payload Structure
Every audited expression is encapsulated into a dedicated tracking object consisting of the source path, line reference number, literal expression string, nearby execution context, and language classification.
Regex Audit Advanced Features
- Multi-Language Support: Seamlessly handles polyglot architectures containing JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, and Rust configurations.
- Automated Context Evaluation: Sniffs adjacent source code lines to flag expressions deployed inside routers, bodies, queries, and authentication validation hooks.
- CI Automation Compatibility: Provides clean command flags for JSON schema generation, facilitating easy integration into unit test frameworks and server hooks.
- Precision Testing Mode: Enables developers to dry-run explicit query rules against a single expression target string using individual pattern test flags.
SKILL.md
Loading
Related Openclaw Skills
Post Forensics (phy-post-forensics)
An open-source, zero-dependency structural and linguistic post analyzer that helps you understand exactly why your social media posts succeed or fail.
Platform Rules Engine
A local, zero-dependency Python CLI tool that scans social media drafts against 30+ algorithmic rules to prevent shadowbans, link penalties, and downranking.
Content Compound
An automated content atom library builder that scans past content to extract reusable ideas, claims, and data points, eliminating blank-page creator burnout.
Frontend Design
An expert frontend design skill that guides AI agents to construct high-quality, production-grade web interfaces and components that avoid generic AI aesthetics.
GraphQL Schema Audit
A local static analyzer for GraphQL SDL or introspection JSON that catches performance vulnerabilities, security flaws, and architectural risks.
Bundle Size Audit
A zero-API, local bundle size auditor that parses build artifacts to enforce size budgets and eliminate dependency bloat.
Featured*
