wtf is codeauditskill?

CodeAuditSkill is a skill that runs inside Claude Code for auditing the source code of web projects and finding security vulnerabilities. Given the path to a web project, it automatically detects which programming language and framework the project uses, then works through a checklist of vulnerability types specific to that language. For each vulnerability of high or medium severity that it finds, it launches a separate sub agent in parallel to verify whether the issue can actually be exploited, before producing a final audit report that a security team could hand off and act on. The tool covers five languages: Go, Java, Python, PHP, and JavaScript running on Node.js. It checks for more than ten categories of web vulnerabilities, including SQL injection, server side request forgery, cross site scripting, command injection, path traversal, insecure deserialization, authentication bypass, XML external entity attacks, sensitive information leaks, and logic flaws. The README lists a track record: the tool has been used to find and report 43 vulnerabilities across 23 well known open source projects, each one assigned an official CNVD number, which is a Chinese national vulnerability database identifier similar in purpose to a CVE. The affected projects span note taking apps, admin panels, content management systems, IoT platforms, and infrastructure tools, with severity scores ranging from low logic defects up to critical remote command execution bugs. Each finding is checked by a person before being submitted to CNVD. The README also documents the internal design of the audit pipeline in some detail, describing how it tracks which files have already been reviewed, constrains what tools each sub agent is allowed to call, reserves conversation turns for deeper investigation, runs a second pass to look for similar bugs elsewhere in the codebase once one is found, and verifies multiple candidate vulnerabilities at the same time using parallel agents. The project is released under the MIT License.