bogenc/audit-codebase

audit-codebase is a Claude skill, meaning it is a set of instructions Claude follows when you ask it to review a codebase for security problems. Instead of running the same long checklist against every project, it works in three stages. First it does reconnaissance: it reads the code and maps out what the app actually exposes, such as entry points, where user input ends up, the framework in use, the data stores, and how authentication works. Only after that does it decide which categories of vulnerabilities are worth checking, skipping any category the code has no way of triggering. Once recon is done, the skill spawns several specialist sub agents in parallel, each assigned a themed cluster of related vulnerability classes, such as injection issues, access control problems, or server side request handling and file uploads. Each specialist reads a dedicated reference file for its topic before looking at your code, which keeps it focused instead of pattern matching blindly. Finally the results are combined into one report, ranked by real world severity, with confirmed findings kept separate from suspected ones that still need a human to verify, plus an honest list of what the scan did not cover. Installation is just cloning the repository into your Claude skills folder, there is nothing to build and no extra API keys needed beyond the Claude session you are already using. You can trigger it with plain language, such as asking it to scan a codebase, audit a specific API, or check whether one file is exploitable, and you can point it at a narrow path or let it default to the whole repository. The project is explicitly a defensive, source reading audit tool. It does not run exploits or send payloads at live systems, and it is meant to support a human security review rather than replace one. Its vulnerability reference material is adapted from the open source Strix project under the Apache 2.0 license, with attribution retained.