GiulioDER

Cca Audit — Security skill for Claude Code

Security community

Parallel multi-agent code audit + fix pipeline for Claude Code.

How to install Cca Audit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open GiulioDER/cca-audit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cca Audit does

Parallel multi-agent code audit + fix pipeline for Claude Code. One tiered /audit-fix command auto-selects FAST/STANDARD/DEEP by diff size + risk, running up to 11 specialized auditors plus anti-hallucination, anti-regression, and fix→finding verification gates. Any language, one command.

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Design Compliance — Audit or generate regulation-specific UI patterns for HIPAA, PCI DSS, or ADA compliance 309 ★

README

CCA-Audit

**A multi-agent code auditor for [Claude Code](https://docs.anthropic.com/en/docs/claude-code) and Codex in which no unverified finding is allowed into the fix plan.**

Eleven specialised auditors read your diff in parallel. Their findings are deduplicated, then each one is **re-derived against the real code** — mechanically, by `pyright`, `clippy`, `semgrep`, `pytest` or `hypothesis` wherever a tool can settle the claim, and by adversarial review where none can. Only verified findings that survive that gate are eligible to be fixed. The fix is then checked for scope creep, and the whole change is gated on a mapping proving every confirmed finding has a fix and every edit has a finding.

**Python and Rust** have deterministic settlers. Each language gets the claim vocabulary that actually carries information in it — Rust does not get `nullability`, because the code compiled; it gets `panic_path`, `overflow` and `error_swallow` instead. Any other language, and any claim type a backend does not declare, escalates rather than being settled by a tool built for something else.

The design constra