reads code · finds risks · keeps you safe
16 domains · 3 modes · ci support

🔐 Security Audit Skill for LLM Coding Agents

CICADA

· Security Audit Skill ·

One command. Your agent scans your entire codebase across 16 security domains — auth, cloud, mobile, crypto, CI/CD, and more — then optionally fixes everything.

LLM Compatible 16 Audit Domains 3 Operation Modes CI Integration MIT License Read-Only by Default
Get Started View on GitHub
16 Audit Domains
3 Modes
10+ Frameworks
4 Agents
↓ scroll
Installation

One-Line Install

Paste this in your terminal. Cicada installs SKILL.md and config files into a .cicada/ directory in your project root. That's it.

bash 
bash <(curl -fsSL https://raw.githubusercontent.com/Synthrun/Cicada/main/install.sh)
local repo 
# If the repo is already cloned locally:
bash path/to/cicada/install.sh
Tip: The LLM agent can also auto-install for you — just tell it "install cicada" and it will run the install script on your behalf, then immediately start the audit.
After Install

Invoke the audit

in your agent chat 
/cicada             # primary command

# or say any of these:
security audit
vulnerability scan
audit my backend
check for vulnerabilities
is my app secure
pentest my code

Compatible frameworks — auto-detected, no config needed:

Node.js Express Next.js NestJS Django Flask FastAPI Go / Gin Rails Laravel Spring Boot Flutter React Native
Workflow

How It Works

Cicada is a structured prompt skill — your LLM agent loads it, then executes a systematic audit across your codebase. Every step is transparent and controllable.

01
Invoke
You type /cicada (or a trigger phrase). Your agent loads the SKILL.md engine.
02
Choose Mode
Agent asks: report-only, interactive fix, or auto-fix all. You pick. It never touches code without your say.
03
Detect Stack
Reads package.json, requirements.txt, pubspec.yaml, etc. Only runs checks relevant to your stack.
04
Audit
Sweeps all 16 domains. Searches patterns, reads context (20–40 lines), assesses severity.
05
Fix & Report
Applies fixes (if mode 2/3). Generates report.md with every finding, severity, and file:line reference.
Operation

3 Operation Modes

Choose your level of automation. Cicada asks before it acts — always.

01
Report Only
Full audit, zero changes. Agent reads every source file, runs all checks, and produces a report.md with severity ratings and file:line references. Nothing touched.
Read-only · Best for CI
02
Interactive Fix
For each finding, agent asks "Fix this? (y/n/skip-all)". Fixes are applied only on explicit confirmation. Final report documents what was fixed and what was skipped.
Guided · Best for review
03
Auto-Fix All
Full audit runs, summary shown. One confirmation: "Fix all? (y/n)". Optional diff preview. All fixes applied, every change documented in the final report.
Automated · Best for speed
Read-only by default. Cicada never modifies your code until you explicitly choose Mode 2 or Mode 3 and confirm. Every fix includes a copy-paste snippet in the correct language for your stack.
Coverage

16 Audit Domains

Every check includes pattern searches, contextual code reads, severity assessment, and a ready-to-use fix snippet. Framework auto-detection means only relevant checks run.

01 🔑
Auth & Sessions
JWT, OAuth, magic links, MFA, timing attacks, account lockout, session invalidation
02 🔒
Password Reset
Token generation entropy, expiry, single-use enforcement, enumeration protection
03 🔌
Connectors
API keys, webhooks, DB connections, third-party SDK secrets, signature verification
04 { }
API & Input
SQL/NoSQL/command injection, CORS, rate limiting, input validation, security headers
05 🗝️
Secrets & Config
.env exposure, hardcoded keys, credential logging, gitignore checks
06 📦
Dependencies & Infra
Outdated packages, HTTPS enforcement, TLS config, error handling patterns
07 🌐
Web Frameworks
Express, Next.js, NestJS, Django, Flask, FastAPI, Gin, Rails, Laravel, Spring Boot
08 📱
Mobile Security
Flutter + React Native: deep links, secure storage, SSL pinning, obfuscation, ATS
09 ☁️
Cloud & Infrastructure
Docker, Kubernetes, S3 buckets, IAM roles, security groups, CloudTrail, VPCs
10 ⬡
GraphQL
Introspection, query depth limits, cost analysis, per-resolver auth, batching attacks
11 ⚡
WebSocket
Origin validation, WS auth, message rate limiting, replay protection, idle timeout
12 📎
File Upload
Magic bytes validation, size limits, zip bombs, path traversal, EXIF stripping
13 🛡️
Data Privacy
PII classification, GDPR/CCPA, data export/delete, consent records, retention
14 🔐
Cryptography
Weak hashes (MD5/SHA1), ECB mode, static IVs, key rotation, JWT algorithm confusion
15 🔗
CI/CD Supply Chain
Pipeline secrets, lockfiles, dependency confusion, typosquatting, SBOM, signed commits
16 📋
Logging & Monitoring
Log injection, PII in logs, audit trails, alerting gaps, health check leaks
Agent Compatibility

Works With Your Agent

Cicada ships with AGENTS.md and opencode.json for agent registration. Each agent loads SKILL.md differently — setup is automatic after install.

CLAUDE
Place AGENTS.md in project root or .claude/. Claude reads it automatically. Type /cicada to invoke.
/cicada
OPENCODE
Place opencode.json + AGENTS.md in project root. Registered as a slash command automatically.
/cicada
CODEX
Load SKILL.md directly. Codex reads it from context and runs the audit on command.
/load-skill SKILL.md → /cicada
CURSOR / WINDSURF
Load SKILL.md as a rules file, or use the .cicada config marker for automatic discovery.
Rules file or .cicada config
Agent Trigger Phrases

What activates Cicada

/cicada security audit vulnerability scan check for vulnerabilities find security issues is my app secure audit my backend audit my auth OWASP review pentest my code HackerOne style review fix security issues patch vulnerabilities audit my Flutter app is this production-ready
Repository

Repository Structure

Everything Cicada needs ships in a single flat repo. No dependencies. No runtime.

cicada/
├── SKILL.md               ← Main skill — security audit engine (2199 lines, 16 domains)
├── AGENTS.md              ← Agent config for CLAUDE / OPENCODE (/cicada trigger)
├── install.sh             ← One-line installer — copies files, creates .cicada/
├── report.md              ← Generated audit report (created on each run)
├── .env.example           ← Secure env template (no real secrets)
├── .gitignore             ← Standard ignores
├── .cicada                ← Config marker for LLM tool discovery
└── templates/
    └── report-template.md ← Report output template
Automation

CI Integration

Drop Cicada's checks into your GitHub Actions pipeline. Catch secrets, injections, and vulnerable deps on every pull request — before they merge.

1
Hardcoded Secrets Scan — grep for string literals ≥32 chars matching API key patterns across *.js, *.ts, *.py, *.go. Fails build on hit.
2
Command Injection Check — scan for exec(\` patterns in JS/TS source files. Flags potential shell injection vectors.
3
Weak RNG for Tokens — detect Math.random or Date.now near token/secret/reset/magic keywords. Flags insecure randomness.
4
Dependency Audit — runs npm audit --audit-level=high automatically if package.json is present. Blocks on high/critical CVEs.
.github/workflows/security-audit.yml 
name: Security Audit
on: [pull_request]
permissions:
  contents: read
  checks: write
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
            # hardcoded secrets
            - name: Scan secrets
        run: |
            if grep -rE "['\"][A-Za-z0-9_\-]{32,}['\"]" \
              --include="*.{js,ts,py,go}" --exclude-dir=node_modules; then
              echo "Potential secrets found!"; exit 1; fi
            # dep audit
            - name: npm audit
        run: |
            if [ -f package.json ]; then npm audit --audit-level=high; fi