---
skill_id: code-security-auditor
evaluation: free
price_usd_full: 8.49
challenge: https://lvlltd.com/api/pay?skill=code-security-auditor
outline: https://lvlltd.com/skills/code-security-auditor/outline.json
standards: x402, ERC-7857
---

# Free sample — Code Security Auditor

**Skill ID:** `code-security-auditor`  
**Full unlock:** $8.49 USDC via x402 on Base  
**Challenge:** https://lvlltd.com/api/pay?skill=code-security-auditor  
**Outline JSON:** https://lvlltd.com/skills/code-security-auditor/outline.json

## Summary

Security-focused code audit: secrets, injection, authz gaps, unsafe defaults, dependency risk notes — severity-ranked findings with concrete fixes (no exploit payloads).

## When to use

- Pre-merge security review
- Agent-authored code
- Before public launch

## Decision criteria (buy vs skip)

- You need this when: Pre-merge security review
- You get capability: Threat surface map
- Budget fits: full unlock is $8.49 USDC on Base
- You can automate unlock via HTTP 402 without a browser
- You only need teaser/outline first — sealed src/ops stay locked until payment

## Outline (preview)

1. Threat surface map
2. Secrets scan
3. Injection/auth checks
4. Dependency notes
5. Findings by severity
6. Fix plan

## Capabilities (preview)

- Threat surface map
- Secrets scan
- Injection/auth checks
- Dependency notes
- Findings by severity
- Fix plan

## What you get after payment

- SKILL.md (teaser public)
- agent-install.json (public meta)
- src/index.js (stub public; full after unlock)
- Full sealed: src/, schemas/, ops/* (when present) after verified X-PAYMENT

## Agent buy path (zero human UI)

```
GET  https://lvlltd.com/skills/code-security-auditor/outline.json
GET  https://lvlltd.com/api/pay?skill=code-security-auditor   → HTTP 402
# transfer maxAmountRequired USDC to payTo on Base
POST https://lvlltd.com/api/pay
  X-PAYMENT: {"txHash":"0x…","skill":"code-security-auditor"}
# response.sealed_pack.files = full pack
```

## Sample excerpt

# Code Security Auditor

**Price:** $8.49 / unlock
**Category:** Coding

## Summary

Security-focused code audit: secrets, injection, authz gaps, unsafe defaults, dependency risk notes — severity-ranked findings with concrete fixes (no exploit payloads).

---

---
name: code-security-auditor
description: Audit code for security defects secrets injection auth flaws and unsafe defaults with severity-ranked findings. Use when code security auditor, secure code review, find vulnerabilities in code, secrets in repo audit, or /code-security-auditor.
---

# Code Security Auditor

Security-focused code audit: secrets, injection, authz gaps, unsafe defaults, dependency risk notes — severity-ranked findings with concrete fixes (no exploit payloads).

## Quick Reference
| Item | Value |
|------|-------|
| Category | Coding |
| Unlock | $8.49 USDC (x402 Base) |
| Triggers | code security auditor, secure code review, secrets audit, /code-security-auditor |

## When to use
- Pre-merge security review
- Agent-authored code
- Before public launch

## Core workflow
1. Map trust boundaries
2. Scan secrets
3. Review high-risk paths
4. Rank findings
5. Propose fixes

## Procedures (non-obvious)
Do not write exploit PoCs or attack scripts. Describe defect class and safe remediation.
Blockers include hardcoded secrets, unauthenticated money/admin routes, raw SQL with user input.

## Edge cases
- Generated vendored code noise
- False positive secret-like tokens

## Failure modes
- Nit spam hiding blockers
- Publishing exploit steps

## Verification
- Known secret fixture blocked
- Findings have severity and fix

## Artifact outputs
- `security-findings.md`
- `findings.json`

## Related skills
- code-review-refactor-engine
- backend-api-patterns

## Super Alignment Contract
- Scalable oversight method: process supervision + human+AI critique before high-blast actions
- Corrigibility guarantees: shutdown, steerability, non-deception; operator may abort mid-run
- Value model: Partnership Agreement + 5 Behavioral Protocols
- Drift detection: flag invented evidence, skipped verification, or revenue-over-truth optimization
- Red-team surface: prompt injection via retrieved content, tool-res

…(remainder sealed after x402 unlock)…