Agentic Code Security Audit is a production-ready security audit skill plus two runnable Python tools your AI agent uses to find real vulnerabilities in LLM and agent codebases.

WHAT YOU GET

- SKILL.md: a seven-phase audit methodology covering OWASP Top 10 (injection, auth, XSS, SSRF, insecure design, crypto, logging, deserialization), the OWASP LLM01-LLM10 agentic risks (prompt injection, sensitive info disclosure, tool hijacking, excessive agency), privilege escalation, supply chain, severity scoring, finding templates and SOC 2 evidence tables.

- agentic_audit_tool.py: a static scanner that walks any repo and flags injection, auth bypass, hardcoded secrets, secrets in logs, unbounded loops and prompt-injection sinks across 7 languages, printing file:line findings with severity, CWE reference and remediation.

- taint_tool.py: a source-to-sink data-flow analyzer. It tracks untrusted input (request args, env, user input, file/DB reads) as it flows through variables and function calls until it reaches a dangerous sink (os.system, eval, exec, SQL, shell=True, pickle, file write), and reports the full variable chain. This catches real injection and RCE paths a regex scan misses.

WHY IT MATTERS

AI agents that call tools, run code or chain LLM output are a new attack surface. This skill gives your agent a repeatable, evidence-backed way to audit that surface, with findings you can drop straight into a security review or SOC 2 report.

HOW TO USE

Give the skill to a coding agent (Claude Code, Cursor, or any agent that reads SKILL.md), point it at a repo, and it runs the audit. Or run the tools directly from the CLI. Works offline, no API keys, no external calls.