An advanced white-box security auditing expert that performs deep data flow analysis and business logic verification to identify high-risk code vulnerabilities.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-dfyx-code-security-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-dfyx-code-security-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is DFYX Code Security Review?
DFYX Code Security Review is an elite white-box security auditing tool designed to operate as a virtual DevSecOps expert. It specializes in identifying high-risk vulnerabilities, logical defects, and architectural risks by simulating hacker attack vectors. It is a highly specialized asset within Openclaw Skills.
By combining deep data flow analysis with a thorough comprehension of business logic, this skill bridges the gap between raw code scanning and actionable threat modeling. It ensures that your codebases are resilient against modern security threats prior to deployment.
DFYX Code Security Review Use Cases
- Performing comprehensive security audits on newly written or legacy source code.
- Tracking untrusted user inputs from sources to unsafe sinks to prevent injection and bypass flaws.
- Verification of authorization logic, token handshakes, and access control lists.
- Finding logic flaws such as race conditions, mass assignments, and insecure direct object references (IDOR).
- Checking third-party supply chain components for known CVEs and outdated dependency versions.
How DFYX Code Security Review Works
- Reconnaissance: It identifies all API entry points, maps authentication middleware, and profiles the complete technology stack.
- Threat Modeling: It maps out data flow diagrams and identifies logical pathways from source inputs to critical sinks.
- Vulnerability Mining: Leveraging both sink-driven (tracing unsafe functions backward) and control-driven (validating active security controls) approaches to locate defects.
- Verification: Validating potential vulnerabilities to weed out false positives and assessing exploit complexity.
- Reporting: Delivering remediation advice and practical DevSecOps guidelines.
DFYX Code Security Review Setup
To deploy and trigger this skill within your Openclaw Skills workflow, use the following commands or natural language queries inside your terminal or agent chat window:
# Run a comprehensive security audit on the entire workspace
请审计这个项目的安全问题
# Target specific vulnerabilities like SQL Injection
帮我看看有没有 SQL 注入
# Output a structured security audit report
生成一份安全审计报告
DFYX Code Security Review Data Schema & Taxonomy
The skill analyzes your project structure and produces structured outputs organized across 10 security dimensions:
Security Audit Dimensions
| Dimension Code | Category | Core Audit Target |
|---|---|---|
| D1 | Injection | SQL, Command, LDAP, SSTI, SpEL, JNDI injections |
| D2 | Authentication | Token validity, Session security, JWT configuration, Filter chains |
| D3 | Authorization | CRUD permission consistency, IDOR vulnerabilities |
| D4 | Deserialization | Gadget chain analysis and unsafe deserialization methods |
| D5 | File Operations | Insecure file upload/download, Path traversal controls |
| D6 | SSRF | URL injection paths, Protocol restrictions (e.g., gopher, file) |
| D7 | Cryptography | Key management practices, Insecure cipher modes |
| D8 | Configuration | Actuator exposure, CORS policies, Sensitive error leaks |
| D9 | Business Logic | Race conditions, Mass assignments, State-machine bypasses |
| D10 | Supply Chain | Dependent CVE checks, Outdated version detection |
Generated Artifacts
- Project Architecture Map: Generated as a visual Mermaid diagram flow.
- Tech Stack Profiling Report: A breakdown of the frameworks, libraries, and languages used.
- Vulnerability Backlog: A prioritized list of discovered bugs ordered by severity and exploitability.
- Remediation Guidelines: Code snippets illustrating secure alternatives and patches.
DFYX Code Security Review Advanced Features
- Three-Layer Analysis Methodology: Combines fast pattern matching (Grep) with sequential line-by-line tracing (Read) and semantic logical verification (Point) to ensure near-zero false-positive rates.
- Interactive Source-to-Sink Tracking: Follows inputs dynamically across complex routing mechanisms and filter layers.
- DevSecOps Integration: Supports outputting standardized markdown reports ready to be piped directly into pull requests or issues tracking systems.
SKILL.md
Loading
Related Openclaw Skills
Git Sentinel (Code Reviewer)
A specialized AI agent skill that transforms your assistant into a merciless Senior Software Engineer and Security Auditor for rigorous code gatekeeping.
Daolv Hotel Booking Assistant
An AI-driven booking decision assistant that leverages MCP protocols to fetch real-time hotel data, compare room rates, and assess cancellation risks.
Suno Music Generation
An advanced music generation skill that interfaces with Suno to create full songs, custom lyrics, and instrumental tracks via a self-hosted API.
OpenClaw Repair Kit
An automated health check and diagnostic tool designed to fix configuration errors and sync issues after upgrading OpenClaw.
Gitrama
Gitrama is a CLI-based intelligence layer that brings AI-powered semantic search and automated repo insights to your local git history.
Architecture Research
An advanced AI agent skill designed to analyze source code, uncover design rationale, and generate professional ELK-based architecture diagrams.
Featured*
