php-codeigniter-audit

Original：🇨🇳 Chinese

Translated

Security audit tool for CodeIgniter framework. Conducts white-box static audits on CodeIgniter's mechanisms such as CSRF, XSS output filtering, database query construction, routing and validator configuration, session Cookie security, etc., and maps them to a common vulnerability type system (CSRF/AUTH/XSS/SQL/CFG/SESS, etc.).

2installs

Source0xshe/php-code-audit-skill

Added on2026-08-18

NPX Install

npx skill4agent add 0xshe/php-code-audit-skill php-codeigniter-audit

SKILL.md Content (Chinese)

View Translation Comparison →

PHP CodeIgniter Framework Security Audit (php-codeigniter-audit)

Analyze framework mechanisms and configuration pitfalls in CodeIgniter projects, focusing on:

Whether CSRF protection is enabled and whether the token name/validation logic is correct
Output filtering and XSS protection (whether CI's built-in filters are disabled or misused)
Database query construction: whether user input is spliced into
```
$this->db->query
```
or raw SQL
Whether form validators are overridden or bypassed
Security of session Cookie flags (CI session settings)

Input

User provides:

```
source_path
```
: Root directory of the CodeIgniter project Optional:
```
output_path
```
: Output directory path (default
```
{source_path}_audit
```
)

Output Directory

Output to:

{output_path}/framework_audit/
  codeigniter_{timestamp}.md

Framework Identification (Mandatory)

Identification evidence must be provided (no empty assertions allowed):

Typical directories:
```
application/
```
,
```
system/
```
Configuration files:
```
application/config/config.php
```
or session/security configuration files
Version clues:
```
composer.json
```
or structure of
```
system/core/
```

Risk Type Mapping (Mandatory)

Each finding must specify:

Common type code:
```
CSRF
```
/
```
XSS
```
/
```
SQL
```
/
```
AUTH
```
/
```
CFG
```
/
```
SESS
```
/
```
LOGIC
```
, etc.
Mapping reason

Mandatory Audit Checklist (Mandatory: Check item by item and output results)

1) CSRF Protection (CSRF)

Must locate and output:

Whether CSRF is enabled (CI 3: csrf configuration in
```
config.php
```
, CI 4: Security class configuration)
Token name, validation entry and skip rules (whether some controllers/methods have not enabled validation)

Judgment rules:

If there is a state change route but CSRF is not enabled, output CSRF risk

2) XSS Output Protection (XSS/CFG)

Must locate and output:

Whether CI's XSS filters are enabled (such as
```
global_xss_filtering
```
,
```
Security::xss_clean
```
, etc.)
Whether the view layer correctly performs
```
html_escape
```
or equivalent escaping on user input

Judgment rules:

If filtering is disabled or output is unescaped, and user input can enter view output, output XSS risk

3) Database Query Splicing (SQL)

Must locate and output:

Raw queries: Evidence of splicing in

$this->db->query($sql)

or

->query($userInput)

Correct approach: Use of Query Builder and bound parameters

Judgment rules:

If user input is spliced into SQL strings, output SQL risk

4) Session and Cookie (SESS/CFG)

Must locate and output:

Cookie flags: HttpOnly/Secure/SameSite (as configured in the project)
Session configuration: Session timeout, fixation protection (if present)

5) Authentication and Access Control (AUTH)

Must locate and output:

Access protection modes in controllers: Custom
```
auth
```
helper, base class controller validation, filters
Route layer filters or middleware (CI 4 filters)

Judgment rules:

If sensitive controllers or methods lack unified authentication, output AUTH risk

Observable PoC (Mandatory: Framework-specific Observable Validation Framework)

Provide at least one of the following two types and clearly write the observation points:

CSRF: Call state change routes without CSRF token, observe success and side effects
SQL: Call suspected SQL splicing paths using injection payloads, observe return differences or error echoes

Output Integrity Check (Mandatory)

Output includes: Check results of CSRF/XSS/SQL/Session/Auth
Each risk has: Mapping type code + location evidence + observable validation framework + repair suggestions

php-codeigniter-audit

NPX Install

Tags

SKILL.md Content (Chinese)

PHP CodeIgniter Framework Security Audit (php-codeigniter-audit)

Input

Output Directory

Framework Identification (Mandatory)

Risk Type Mapping (Mandatory)

Mandatory Audit Checklist (Mandatory: Check item by item and output results)

1) CSRF Protection (CSRF)

2) XSS Output Protection (XSS/CFG)

3) Database Query Splicing (SQL)

4) Session and Cookie (SESS/CFG)

5) Authentication and Access Control (AUTH)

Observable PoC (Mandatory: Framework-specific Observable Validation Framework)

Output Integrity Check (Mandatory)