UserB1ank

Code Audit System — Security skill for Claude Code

Security community

A CVE-oriented multi-agent code audit system implemented as a Claude Code skill.

How to install Code Audit System

This entry records only its repository, not the path inside it, so there is no exact command to give. Open UserB1ank/code-audit-system and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Code Audit System does

A CVE-oriented multi-agent code audit system implemented as a Claude Code skill. It orchestrates parallel subagents to discover exploitable vulnerabilities in git repositories, write weaponized POCs, verify them against live deployments, and generate CVE-ready reports.

Alternatives in Security

Maestro Odyssey — Long-running iterative cycle — one entry, seven modes (debug improve planex review security defensive ui) 530 ★
Agent Memory Vault — Markdown-first shared memory vault for Claude Code and Codex with SQLite, Zvec, Git, closeout, and audit 314 ★
Tier 3 Code Refinement Report — Date: 2026-03-20 Status: ALL 54 FINDINGS IMPLEMENTED Scope: Full codebase (18 plugins, 888 files, ~266K lines) 222 ★

README

Code Audit System — Multi-Agent CVE Discovery Engine

A **CVE-oriented multi-agent code audit system** implemented as a Claude Code skill. It orchestrates parallel subagents to discover exploitable vulnerabilities in git repositories, write weaponized POCs, verify them against live deployments, and generate CVE-ready reports.

**Core philosophy**: Only report actually exploitable vulnerabilities. The goal is CVE submission, not making code safer.

Architecture

┌──────────────────────────────────────────────────────────┐
│                     MainAgent (Orchestrator)              │
│  · Fast pre-scan → immediate subagent dispatch            │
│  · Deep reconnaissance (parallel with subagents)          │
│  · Incremental intelligence injection into subagents      │
│  · Workspace & state management                           │
│  · Final report aggregation                               │
└──────────────────────────────────────────────────────────┘
        │                    │                    │
        ▼                    ▼                    ▼
┌──────────────┐  ┌──────────────┐  ┌──────────────┐
│  Subagent 1  │  │  Subagent 2  │  │  Subagent N  │
│  Module A    │  │  Module B    │  │  Module N    │
│              │  │              │  │              │
│  Recon       │  │  Recon       │  │  Recon       │
│  Source→Sink │  │  Source→Sink │  │  Source→Sink │
│  Exploit Eval│  │  Exploit Eval│  │  Exploit Eval│
│  CVE Report  │  │  CVE Report  │  │  CVE Report  │
└──────────────┘  └──────────────┘  └──────────────┘

Key Features

Parallel subagent auditing — modules are audited simultaneously, not sequentially
Two audit modes — Standard (direct code audit) and Specialized (CVE-history-driven hunting)
Graph-enhanced reconnaissance — codebase-memory MCP builds code knowledge graphs for Source→Sink tracing
Incremental intelligence injection — MainAgent feeds deep recon findings to subagents mid-audit
**Live POC verification