codescan-review

@hejiguang · 收录于 1 周前 · 上游提交 3 个月前

Use when reviewing source code for security issues and CodeScan MCP tools or CLI are available, especially for pre-merge diff review, repository intake, suspicious auth or input-handling code, or when a user explicitly asks for a CodeScan-based security scan.

场景代码评审安全审计合并前检查

适合你，如果你需要在代码合并前自动扫描安全漏洞

/ 下载安装

https://github.com/hejiguang/codescan/tree/main/skills/codescan-review ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add hejiguang/codescan/codescan-review

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- hejiguang/codescan/codescan-review

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify hejiguang/codescan/codescan-review

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

22GitHub stars

~560最小装载

~560含声明引用

~631文本包总量

索引托管

怎么用

商店整理自技能原文 · 版本 13f71b1 · 表述以原文为准

它做什么

装上后，Claude 会变成安全代码审查员。它会用 CodeScan 工具扫描代码，找出安全漏洞（如认证、输入验证、SQL 注入等问题），并按严重程度列出结果，给出修复建议。

什么时候触发

当用户要求进行安全审查、漏洞扫描、合并前差异审查，或代码涉及认证、密钥、输入验证等敏感逻辑时触发。

装好后可以这样说

Claude 会扫描该文件并报告安全问题。

Claude 会运行 git diff 扫描。

Claude 会扫描整个目录。

技能原文 SKILL.md作者撰写 · MIT · 13f71b1

CodeScan Review

Overview

Use CodeScan as a focused security reviewer. Prefer MCP tools when they are available. Fall back to the CLI only when MCP is unavailable.

Prioritize exploitable findings over style issues or generic code smell commentary.

When To Use

The user asks for a security review or vulnerability scan
The user wants a pre-merge or branch-diff review
The code under review handles auth, secrets, input validation, file access, command execution, SQL, HTML rendering, network callbacks, or crypto
The user wants CodeScan specifically, not just a generic security opinion

Do not use this skill for general refactoring, style cleanup, or performance review unless the user explicitly widens scope.

Tool Selection

Use scan_file for a focused review of one file
Use scan_directory for repository or module sweeps
Use scan_git_diff for active-branch or pre-merge review
Use scan_github_repo when the target repo is only available as a Git URL

Prefer the smallest scope that answers the user's request.

Workflow

Pick the narrowest scan that matches the request.
Run CodeScan through MCP first.
Read the structured findings and separate strong signals from weaker suspicions.
Manually inspect any critical or high finding before presenting it as real.
Respond with findings first:
severity
file path and line
why it is risky
concrete remediation
If no credible finding remains, say that explicitly and mention any residual blind spots.

Fallback

If MCP tools are unavailable but codescan is installed locally, use the CLI:

python -m codescan file <path>
python -m codescan dir <path>
python -m codescan git-merge <base-branch>

If downstream parsing matters, prefer JSON output instead of HTML.

Output Standard

List findings before summaries
Order by severity
Use file and line references whenever possible
Distinguish confirmed issues from lower-confidence suspicions
Keep remediation concrete and code-facing
Mention scan scope limits if the scan was partial

Notes

CodeScan is strongest when used as a security triage tool, not as the sole source of truth
For active code review, scan_git_diff is usually the highest-value default
For one suspicious file, scan_file is usually better than a full repository sweep

按 MIT 许可原样转载,未经改动 · 在 GitHub 查看 →

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…