[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6M445BZF5CP0C4VCF538T36":3,"skill-same:01M6M445BZF5CP0C4VCF538T36":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":6,"updatedAt":51,"install":52,"resources":64},"01M6M445BZF5CP0C4VCF538T36","security-audit",null,"Audits a codebase for security vulnerabilities, independently verifies each one, and writes a report. Use when asked for a full, multi-phase codebase security audit or pen test, or for focused security guidance on code.","rubakas\u002Fagent-notes","rubakas","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F35782457?v=4","01M6C4THGGA9DDE6AAEF5SZF6V","01M6C4THN6FV04VNKF1NG01W68",4,"MIT","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"audit","security audit","security","process","codebase","for","path","true","multi","full","guidance","use","guide","security guidance","codebase security audit","report","code","test","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: security-audit\ndescription: \"Audits a codebase for security vulnerabilities, independently verifies each one, and writes a report. Use when asked for a full, multi-phase codebase security audit or pen test, or for focused security guidance on code.\"\nargument-hint: \"[guide|audit] [path]\"\ndisable-model-invocation: true\ngroup: process\n---\n\n# Security Audit\n\nFind vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.\n\n## Operating modes\n\nThis skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.\n\n- **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill: read `ATTACK-CLASSES.md` and the one companion matching the target's boundary, apply Universal execution safety, and create no files. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.\n- **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.\n\nIf the request could mean either mode, ask one focused question before creating files or starting the complete workflow.\n\n## Platform terminology\n\nThis skill is agent-neutral:\n\n- **Parent** is the agent that coordinates the run and owns shared state.\n- **Task tool** is the platform's delegation or sub-agent mechanism.\n- **`research` agent** is a delegated agent for focused source exploration and factual verification.\n- **`general` agent** is a delegated agent for broad investigation and bounded local execution.\n- **`subagent_type:`** in a heading names which of these two delegated agent roles runs that work. A heading without it runs as `general`.\n- **On Claude Code** the Task tool is `Agent` (`task` on OpenCode). Map `research` to `explorer` for reconnaissance 1a, 1c, and 1d only. Map `general`, the coverage critics, reconnaissance 1b, and every Phase 5 verifier to `security-auditor`. Open every brief with: \"Ignore your default report format; reply with only the JSON object. Do not run network audit tools.\"\n\nUse equivalent platform capabilities while preserving role, write-isolation, prompt, and independence boundaries.\n\nWherever a file says to launch agents \"in parallel\", launch at most as many at once as `CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS` allows (agent-notes sets 5), and start the next batch as agents finish, because the Agent tool refuses launches past the cap.\n\n## Companion files\n\nSelect the companions that match the target's trust boundaries:\n\n- [MEMORY-SAFETY-AND-BINARY.md](MEMORY-SAFETY-AND-BINARY.md): memory-safety, binary, and kernel hunting classes for native targets\n- [AI-AND-LLM.md](AI-AND-LLM.md): prompt-injection, agent\u002Ftool, and output-handling hunting classes for LLM-backed targets\n- [WEB-PROTOCOL-AND-AUTH.md](WEB-PROTOCOL-AND-AUTH.md): HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets\n- [CLIENT-SIDE.md](CLIENT-SIDE.md): DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side\u002Fbrowser targets\n- [SUPPLY-CHAIN-AND-RELEASE.md](SUPPLY-CHAIN-AND-RELEASE.md): dependency, CI, release, signing, update, plugin, and extension hunting classes\n- [CLOUD-AND-DEPLOYMENT.md](CLOUD-AND-DEPLOYMENT.md): IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes\n- [PROTOCOLS-RPC-AND-MESSAGING.md](PROTOCOLS-RPC-AND-MESSAGING.md): RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes\n- [RESOURCE-EXHAUSTION-AND-AVAILABILITY.md](RESOURCE-EXHAUSTION-AND-AVAILABILITY.md): shared resource, quota, queue, worker, and operator-spend hunting classes\n- [DATA-ISOLATION-AND-LIFECYCLE.md](DATA-ISOLATION-AND-LIFECYCLE.md): tenant isolation, cache, search, export, backup, migration, deletion, and restore hunting classes\n- [DESKTOP-MOBILE-AND-LOCAL-IPC.md](DESKTOP-MOBILE-AND-LOCAL-IPC.md): native app, deep-link, webview, exported-component, helper, daemon, and local-IPC hunting classes\n\n## Universal execution safety\n\nThese rules apply in both operating modes. Source inspection is read-only. Run target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixture processing only inside an OS-enforced sandbox that provides all of these controls:\n\n- no external network; use only an isolated loopback namespace when the check needs local client\u002Fserver traffic;\n- an empty environment populated from an explicit allowlist with safe values, with scratch-local `HOME`, temporary directories, and caches;\n- a read-only target and toolchain, with the target-controlled process able to write only inside its assigned `scratch\u002F` directory; and\n- explicit low CPU, memory, process, file-size, disk, and wall-clock limits.\n\nThe agent, outside the target-controlled process, may make a disposable source copy in an assigned `scratch\u002F` directory when a build must write beside source. In guidance mode, do not retain target-controlled files. In full audit mode, only trusted parent-side code may promote the minimum non-secret result to retained `artifacts\u002F` using the procedure under Write isolation. Never expose a retained output directory (other than the agent's own assigned `scratch\u002F`), another agent's directory, the host home directory, credentials, sockets, or shared services to target code. Do not install dependencies or let builds fetch them. Use only tools and dependencies already available locally. If every control cannot be enforced, do not execute target code: report the missing sandbox capability as a needs-validation blocker and give a safe validation plan.\n\n**Claude Code is source-only.** No OS-enforced sandbox is assumed there. Unless the user names a sandbox command that enforces every control listed above, set `execution_policy: \"source-only\"` in `run-metadata.json`, run nothing from the target, and put `execution: disabled` in every hunter and verifier brief. A lead that needs a run stays `needs_validation`. Tell the user this before wave 1. With execution disabled no record can meet the `confirmed` evidence bar; report source-grounded leads as `needs_validation` with the exact unresolved fact, and say so in the report.\n\nUse dummy principals, fixtures, and secrets. Do not probe deployed endpoints, external services, shared infrastructure, production identities, other users' data, or live control planes. Do not test availability against a live or shared process, publish artifacts, alter releases, spend paid API quota, or continue beyond the minimum local effect needed to establish a defect. If the decisive fact is outside source or the sandboxed fixture, report it as needing validation.\n\n## Full audit setup\n\nIn full audit mode, resolve these values before reconnaissance:\n\n- **Skill directory**: the absolute directory containing this `SKILL.md`.\n- **Target**: the absolute repository root under review.\n- **Repo name**: a stable repository identifier from the directory or local Git remote. Lowercase it, replace every character outside `[a-z0-9._-]` with `-`, and require `^[a-z0-9][a-z0-9._-]{0,63}$` (never `.` or `..`). Then append `-\u003Cfirst 8 hex of sha256 of the absolute target path>`.\n- **Output directory**: a new writable directory outside the target, defaulting to `~\u002Fsecurity-audit-skill\u002F\u003Crepo-name>\u002Frun-\u003CN>`, where `\u003CN>` is the next unused integer. Create `run-\u003CN>` with `mkdir -m 700` (exclusive; on collision take the next `\u003CN>`), and keep the resolved default path under `~\u002Fsecurity-audit-skill\u002F`. Quote every path in shell commands. Use a directory inside the target only when the user explicitly selects it and the parent verifies that version control ignores the whole directory. Otherwise stop and request an external path.\n- **Source ref**: the reviewed commit and whether the worktree is dirty. Run git against the target only as `git -c core.fsmonitor= -c core.hooksPath=\u002Fdev\u002Fnull …`, or with `git ls-files`, `rev-parse`, and `log --stat`. Do not treat unreviewed generated or modified files as another revision.\n\nThe files under `\u003Coutput-dir>` are audit artifacts outside the project. The parent writes them and runs the validators itself; do not delegate this to `coder`. Ask the mode, profile, scope, budget, and output-directory questions once, inside the plan you present for approval, together with the estimated agent count.\n\n### Write isolation\n\nThe parent creates and is the only writer of shared run files:\n\n- `run-metadata.json`\n- `architecture.md`\n- `coverage-ledger.json`\n- `findings.json`\n- `REPORT.md`\n- `FINDINGS-DETAIL.md`\n- `NEEDS-VALIDATION.md`\n\nEach hunter or verifier receives a unique root under `\u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002F`, with separate `scratch\u002F` and `artifacts\u002F` directories. Canonical agent IDs match `^[a-z0-9][a-z0-9_-]{0,63}$` and must not equal a Windows device name such as `con`, `prn`, `aux`, `nul`, `com1` through `com9`, or `lpt1` through `lpt9`. Lowercase IDs prevent case-fold collisions. The agent and every target-controlled process may write only to `scratch\u002F`; retained `artifacts\u002F` is parent-owned, is never exposed to the sandbox, and is writable only by trusted parent-side promotion code. Agents may not change shared files, target source, retained artifacts, or another agent's directory. Do not use `\u002Ftmp` or the host home directory as a writable fallback.\n\nThe promotion procedure for retained artifacts is in [WRITE-ISOLATION.md](WRITE-ISOLATION.md). On Claude Code with execution disabled there is nothing to promote; skip it.\n\nFor a reproduced check, record the command, exact test input, sandbox limits, and only the allowlisted environment variable names plus safe non-secret values needed to reproduce it. Never capture or copy the ambient environment, inherited variables, credential values, authentication state, or unrelated host paths. Launch from an empty environment rather than trying to redact one after execution.\n\nBefore delegation, the parent writes `run-metadata.json` with at least `run_id`, `repo`, `target`, `source_ref`, `profile`, `scope_paths`, `budget` (null if unset), `execution_policy` (`\"sandboxed-source-and-local-only\"`, or `\"source-only\"` as set under Universal execution safety), selected companion files, prior-run paths, shared-file owners, and `run_status: \"in_progress\"`. Update metadata only when those facts change; candidate state belongs in the coverage ledger and `findings.json`.\n\n## Full audit planning\n\nCoverage and prior runs, run profiles and scope, and the cost budget are in [PLANNING.md](PLANNING.md). Read it before reconnaissance in full audit mode.\n\n## Core principles\n\n### Require a boundary and result\n\nFor every candidate, name the lower-trust principal, accepted input or action, intended control, crossed boundary, affected principal or resource, and concrete observed or owner-observable result. Do not elevate a missing best practice, guessed deployment behavior, generic parser crash, or self-impact into a security finding.\n\n### Use bounded local evidence\n\nStatic analysis establishes the source path. Sandboxed local tests resolve behavior when all execution controls are available: a minimal function harness, existing unit test, small parser fixture, dummy-tenant integration test, locally rendered configuration, or bounded isolated-loopback client. Stop at a wrong return value, unauthorized dummy record, sanitizer finding, policy difference, or other minimum effect. Do not extend the local check beyond the minimum boundary result or produce persistence, post-fault, or concealment material.\n\n### Respect source visibility\n\nDeployment controls, proxy behavior, provider settings, browser headers, identity policy, broker ACLs, packaging, and topology are real controls. If they are required and absent from the repository, do not assume either presence or absence. Use `needs_validation` with the exact missing fact and a safe owner-observed or local plan.\n\n### Separate priority from certainty\n\nOnly `confirmed` records receive severity. Likelihood and impact must reflect the demonstrated conditions and result; overall severity cannot exceed demonstrated impact. `needs_validation` means a specific source-grounded boundary hypothesis is blocked, not a low-confidence confirmed vulnerability, and it has no severity.\n\nCalibrate overall severity with these anchors:\n\n- **critical** — an unauthenticated actor gains code execution, full data-store access, or takeover of arbitrary accounts.\n- **high** — an actor fully defeats an explicit security control with real consequences: authentication bypass, cross-tenant read or write, stored script execution affecting other users, authenticated code execution, or an unauthenticated remote stop of a shared service.\n- **medium** — a real boundary violation with limited blast radius, uncommon preconditions, or consequences confined to a narrow resource set.\n- **low** — disclosure of non-secret internals, or an effect requiring sustained effort for minimal gain.\n- **informational** — a confirmed but minimal-impact observation, useful mainly as a prerequisite inside a larger finding.\n\nThe high\u002Fmedium discriminator: does the demonstrated result fully defeat an explicit control for an action with real consequences, or only weaken it? If you cannot state the concrete damage, the severity is lower than it feels.\n\n### Recommend the smallest effective source fix\n\nFor each confirmed finding, identify the invariant the code must enforce and the narrowest source change that enforces it at the last trusted decision point. Prefer specific repository-relative changes and regression tests over generic hardening advice. The audit describes fixes; it does not modify target source.\n\n## Full audit workflow\n\nIn full audit mode, follow all six phases in order:\n\n1. **Reconnaissance** — map the source, trust boundaries, local build paths, companion selections, prior evidence, and initial deterministic coverage ledger with [RECONNAISSANCE.md](RECONNAISSANCE.md).\n2. **Coverage-led hunting waves** — assign isolated hunters from the ledger and collect structured candidate results with [HUNTING.md](HUNTING.md), [ATTACK-CLASSES.md](ATTACK-CLASSES.md), and the selected domain companions.\n3. **Candidate validation** — consolidate fingerprints and give every candidate to a fresh source verifier as defined in [VALIDATION-AND-REPORTING.md](VALIDATION-AND-REPORTING.md).\n4. **Structured output** — write all final `confirmed`, `needs_validation`, and `rejected` records to `findings.json`; validate it with `report-schema.json` and `validate-findings.cjs`, and validate the coverage claim with `validate-coverage-ledger.cjs`.\n5. **Independent record verification** — use fresh agents to verify final source claims and reconcile corrections or state changes.\n6. **Target-neutral report** — derive `REPORT.md`, `FINDINGS-DETAIL.md`, and `NEEDS-VALIDATION.md` from the final records, with no live-probe instructions.\n\nDo not end the run before one of exactly two terminal states: (a) all Phase 6 artifacts are written and both validators pass, or (b) `run_status: \"incomplete\"` is recorded with its exact reason and the gap is disclosed in the report. Never stop mid-phase unless the user stops the run. If `node` is missing, the validators cannot run: record `run_status: \"incomplete\"` with `incomplete_reason: \"validators_unavailable\"`.\n\n## Anti-patterns\n\n1. Checklist deviations presented as vulnerabilities.\n2. Defense-in-depth advice with no reachable boundary violation.\n3. Live or shared-environment testing where bounded local evidence is insufficient.\n4. Guessing provider, proxy, browser, identity, or deployment behavior not present in source.\n5. Treating intended same-principal authority or self-impact as a cross-boundary result.\n6. Reporting a parser or runtime effect stronger than the observed effect.\n7. Emitting prose-only hunter results that cannot be deduplicated or verified.\n8. Re-reporting carried same-source prior confirmed records or using them as exemplars that anchor the hunt.\n9. Assigning severity to `needs_validation` records.\n10. Writing the report before independent verification or letting prose and JSON disagree.\n","# Security Audit\n\nFind vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.\n\n## Operating modes\n\nThis skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.\n\n- **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill: read `ATTACK-CLASSES.md` and the one companion matching the target's boundary, apply Universal execution safety, and create no files. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.\n- **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.\n\nIf the request could mean either mode, ask one focused question before creating files or starting the complete workflow.\n\n## Platform terminology\n\nThis skill is agent-neutral:\n\n- **Parent** is the agent that coordinates the run and owns shared state.\n- **Task tool** is the platform's delegation or sub-agent mechanism.\n- **`research` agent** is a delegated agent for focused source exploration and factual verification.\n- **`general` agent** is a delegated agent for broad investigation and bounded local execution.\n- **`subagent_type:`** in a heading names which of these two delegated agent roles runs that work. A heading without it runs as `general`.\n- **On Claude Code** the Task tool is `Agent` (`task` on OpenCode). Map `research` to `explorer` for reconnaissance 1a, 1c, and 1d only. Map `general`, the coverage critics, reconnaissance 1b, and every Phase 5 verifier to `security-auditor`. Open every brief with: \"Ignore your default report format; reply with only the JSON object. Do not run network audit tools.\"\n\nUse equivalent platform capabilities while preserving role, write-isolation, prompt, and independence boundaries.\n\nWherever a file says to launch agents \"in parallel\", launch at most as many at once as `CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS` allows (agent-notes sets 5), and start the next batch as agents finish, because the Agent tool refuses launches past the cap.\n\n## Companion files\n\nSelect the companions that match the target's trust boundaries:\n\n- [MEMORY-SAFETY-AND-BINARY.md](MEMORY-SAFETY-AND-BINARY.md): memory-safety, binary, and kernel hunting classes for native targets\n- [AI-AND-LLM.md](AI-AND-LLM.md): prompt-injection, agent\u002Ftool, and output-handling hunting classes for LLM-backed targets\n- [WEB-PROTOCOL-AND-AUTH.md](WEB-PROTOCOL-AND-AUTH.md): HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets\n- [CLIENT-SIDE.md](CLIENT-SIDE.md): DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side\u002Fbrowser targets\n- [SUPPLY-CHAIN-AND-RELEASE.md](SUPPLY-CHAIN-AND-RELEASE.md): dependency, CI, release, signing, update, plugin, and extension hunting classes\n- [CLOUD-AND-DEPLOYMENT.md](CLOUD-AND-DEPLOYMENT.md): IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes\n- [PROTOCOLS-RPC-AND-MESSAGING.md](PROTOCOLS-RPC-AND-MESSAGING.md): RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes\n- [RESOURCE-EXHAUSTION-AND-AVAILABILITY.md](RESOURCE-EXHAUSTION-AND-AVAILABILITY.md): shared resource, quota, queue, worker, and operator-spend hunting classes\n- [DATA-ISOLATION-AND-LIFECYCLE.md](DATA-ISOLATION-AND-LIFECYCLE.md): tenant isolation, cache, search, export, backup, migration, deletion, and restore hunting classes\n- [DESKTOP-MOBILE-AND-LOCAL-IPC.md](DESKTOP-MOBILE-AND-LOCAL-IPC.md): native app, deep-link, webview, exported-component, helper, daemon, and local-IPC hunting classes\n\n## Universal execution safety\n\nThese rules apply in both operating modes. Source inspection is read-only. Run target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixture processing only inside an OS-enforced sandbox that provides all of these controls:\n\n- no external network; use only an isolated loopback namespace when the check needs local client\u002Fserver traffic;\n- an empty environment populated from an explicit allowlist with safe values, with scratch-local `HOME`, temporary directories, and caches;\n- a read-only target and toolchain, with the target-controlled process able to write only inside its assigned `scratch\u002F` directory; and\n- explicit low CPU, memory, process, file-size, disk, and wall-clock limits.\n\nThe agent, outside the target-controlled process, may make a disposable source copy in an assigned `scratch\u002F` directory when a build must write beside source. In guidance mode, do not retain target-controlled files. In full audit mode, only trusted parent-side code may promote the minimum non-secret result to retained `artifacts\u002F` using the procedure under Write isolation. Never expose a retained output directory (other than the agent's own assigned `scratch\u002F`), another agent's directory, the host home directory, credentials, sockets, or shared services to target code. Do not install dependencies or let builds fetch them. Use only tools and dependencies already available locally. If every control cannot be enforced, do not execute target code: report the missing sandbox capability as a needs-validation blocker and give a safe validation plan.\n\n**Claude Code is source-only.** No OS-enforced sandbox is assumed there. Unless the user names a sandbox command that enforces every control listed above, set `execution_policy: \"source-only\"` in `run-metadata.json`, run nothing from the target, and put `execution: disabled` in every hunter and verifier brief. A lead that needs a run stays `needs_validation`. Tell the user this before wave 1. With execution disabled no record can meet the `confirmed` evidence bar; report source-grounded leads as `needs_validation` with the exact unresolved fact, and say so in the report.\n\nUse dummy principals, fixtures, and secrets. Do not probe deployed endpoints, external services, shared infrastructure, production identities, other users' data, or live control planes. Do not test availability against a live or shared process, publish artifacts, alter releases, spend paid API quota, or continue beyond the minimum local effect needed to establish a defect. If the decisive fact is outside source or the sandboxed fixture, report it as needing validation.\n\n## Full audit setup\n\nIn full audit mode, resolve these values before reconnaissance:\n\n- **Skill directory**: the absolute directory containing this `SKILL.md`.\n- **Target**: the absolute repository root under review.\n- **Repo name**: a stable repository identifier from the directory or local Git remote. Lowercase it, replace every character outside `[a-z0-9._-]` with `-`, and require `^[a-z0-9][a-z0-9._-]{0,63}$` (never `.` or `..`). Then append `-\u003Cfirst 8 hex of sha256 of the absolute target path>`.\n- **Output directory**: a new writable directory outside the target, defaulting to `~\u002Fsecurity-audit-skill\u002F\u003Crepo-name>\u002Frun-\u003CN>`, where `\u003CN>` is the next unused integer. Create `run-\u003CN>` with `mkdir -m 700` (exclusive; on collision take the next `\u003CN>`), and keep the resolved default path under `~\u002Fsecurity-audit-skill\u002F`. Quote every path in shell commands. Use a directory inside the target only when the user explicitly selects it and the parent verifies that version control ignores the whole directory. Otherwise stop and request an external path.\n- **Source ref**: the reviewed commit and whether the worktree is dirty. Run git against the target only as `git -c core.fsmonitor= -c core.hooksPath=\u002Fdev\u002Fnull …`, or with `git ls-files`, `rev-parse`, and `log --stat`. Do not treat unreviewed generated or modified files as another revision.\n\nThe files under `\u003Coutput-dir>` are audit artifacts outside the project. The parent writes them and runs the validators itself; do not delegate this to `coder`. Ask the mode, profile, scope, budget, and output-directory questions once, inside the plan you present for approval, together with the estimated agent count.\n\n### Write isolation\n\nThe parent creates and is the only writer of shared run files:\n\n- `run-metadata.json`\n- `architecture.md`\n- `coverage-ledger.json`\n- `findings.json`\n- `REPORT.md`\n- `FINDINGS-DETAIL.md`\n- `NEEDS-VALIDATION.md`\n\nEach hunter or verifier receives a unique root under `\u003Coutput-dir>\u002Fagents\u002F\u003Cagent-id>\u002F`, with separate `scratch\u002F` and `artifacts\u002F` directories. Canonical agent IDs match `^[a-z0-9][a-z0-9_-]{0,63}$` and must not equal a Windows device name such as `con`, `prn`, `aux`, `nul`, `com1` through `com9`, or `lpt1` through `lpt9`. Lowercase IDs prevent case-fold collisions. The agent and every target-controlled process may write only to `scratch\u002F`; retained `artifacts\u002F` is parent-owned, is never exposed to the sandbox, and is writable only by trusted parent-side promotion code. Agents may not change shared files, target source, retained artifacts, or another agent's directory. Do not use `\u002Ftmp` or the host home directory as a writable fallback.\n\nThe promotion procedure for retained artifacts is in [WRITE-ISOLATION.md](WRITE-ISOLATION.md). On Claude Code with execution disabled there is nothing to promote; skip it.\n\nFor a reproduced check, record the command, exact test input, sandbox limits, and only the allowlisted environment variable names plus safe non-secret values needed to reproduce it. Never capture or copy the ambient environment, inherited variables, credential values, authentication state, or unrelated host paths. Launch from an empty environment rather than trying to redact one after execution.\n\nBefore delegation, the parent writes `run-metadata.json` with at least `run_id`, `repo`, `target`, `source_ref`, `profile`, `scope_paths`, `budget` (null if unset), `execution_policy` (`\"sandboxed-source-and-local-only\"`, or `\"source-only\"` as set under Universal execution safety), selected companion files, prior-run paths, shared-file owners, and `run_status: \"in_progress\"`. Update metadata only when those facts change; candidate state belongs in the coverage ledger and `findings.json`.\n\n## Full audit planning\n\nCoverage and prior runs, run profiles and scope, and the cost budget are in [PLANNING.md](PLANNING.md). Read it before reconnaissance in full audit mode.\n\n## Core principles\n\n### Require a boundary and result\n\nFor every candidate, name the lower-trust principal, accepted input or action, intended control, crossed boundary, affected principal or resource, and concrete observed or owner-observable result. Do not elevate a missing best practice, guessed deployment behavior, generic parser crash, or self-impact into a security finding.\n\n### Use bounded local evidence\n\nStatic analysis establishes the source path. Sandboxed local tests resolve behavior when all execution controls are available: a minimal function harness, existing unit test, small parser fixture, dummy-tenant integration test, locally rendered configuration, or bounded isolated-loopback client. Stop at a wrong return value, unauthorized dummy record, sanitizer finding, policy difference, or other minimum effect. Do not extend the local check beyond the minimum boundary result or produce persistence, post-fault, or concealment material.\n\n### Respect source visibility\n\nDeployment controls, proxy behavior, provider settings, browser headers, identity policy, broker ACLs, packaging, and topology are real controls. If they are required and absent from the repository, do not assume either presence or absence. Use `needs_validation` with the exact missing fact and a safe owner-observed or local plan.\n\n### Separate priority from certainty\n\nOnly `confirmed` records receive severity. Likelihood and impact must reflect the demonstrated conditions and result; overall severity cannot exceed demonstrated impact. `needs_validation` means a specific source-grounded boundary hypothesis is blocked, not a low-confidence confirmed vulnerability, and it has no severity.\n\nCalibrate overall severity with these anchors:\n\n- **critical** — an unauthenticated actor gains code execution, full data-store access, or takeover of arbitrary accounts.\n- **high** — an actor fully defeats an explicit security control with real consequences: authentication bypass, cross-tenant read or write, stored script execution affecting other users, authenticated code execution, or an unauthenticated remote stop of a shared service.\n- **medium** — a real boundary violation with limited blast radius, uncommon preconditions, or consequences confined to a narrow resource set.\n- **low** — disclosure of non-secret internals, or an effect requiring sustained effort for minimal gain.\n- **informational** — a confirmed but minimal-impact observation, useful mainly as a prerequisite inside a larger finding.\n\nThe high\u002Fmedium discriminator: does the demonstrated result fully defeat an explicit control for an action with real consequences, or only weaken it? If you cannot state the concrete damage, the severity is lower than it feels.\n\n### Recommend the smallest effective source fix\n\nFor each confirmed finding, identify the invariant the code must enforce and the narrowest source change that enforces it at the last trusted decision point. Prefer specific repository-relative changes and regression tests over generic hardening advice. The audit describes fixes; it does not modify target source.\n\n## Full audit workflow\n\nIn full audit mode, follow all six phases in order:\n\n1. **Reconnaissance** — map the source, trust boundaries, local build paths, companion selections, prior evidence, and initial deterministic coverage ledger with [RECONNAISSANCE.md](RECONNAISSANCE.md).\n2. **Coverage-led hunting waves** — assign isolated hunters from the ledger and collect structured candidate results with [HUNTING.md](HUNTING.md), [ATTACK-CLASSES.md](ATTACK-CLASSES.md), and the selected domain companions.\n3. **Candidate validation** — consolidate fingerprints and give every candidate to a fresh source verifier as defined in [VALIDATION-AND-REPORTING.md](VALIDATION-AND-REPORTING.md).\n4. **Structured output** — write all final `confirmed`, `needs_validation`, and `rejected` records to `findings.json`; validate it with `report-schema.json` and `validate-findings.cjs`, and validate the coverage claim with `validate-coverage-ledger.cjs`.\n5. **Independent record verification** — use fresh agents to verify final source claims and reconcile corrections or state changes.\n6. **Target-neutral report** — derive `REPORT.md`, `FINDINGS-DETAIL.md`, and `NEEDS-VALIDATION.md` from the final records, with no live-probe instructions.\n\nDo not end the run before one of exactly two terminal states: (a) all Phase 6 artifacts are written and both validators pass, or (b) `run_status: \"incomplete\"` is recorded with its exact reason and the gap is disclosed in the report. Never stop mid-phase unless the user stops the run. If `node` is missing, the validators cannot run: record `run_status: \"incomplete\"` with `incomplete_reason: \"validators_unavailable\"`.\n\n## Anti-patterns\n\n1. Checklist deviations presented as vulnerabilities.\n2. Defense-in-depth advice with no reachable boundary violation.\n3. Live or shared-environment testing where bounded local evidence is insufficient.\n4. Guessing provider, proxy, browser, identity, or deployment behavior not present in source.\n5. Treating intended same-principal authority or self-impact as a cross-boundary result.\n6. Reporting a parser or runtime effect stronger than the observed effect.\n7. Emitting prose-only hunter results that cannot be deduplicated or verified.\n8. Re-reporting carried same-source prior confirmed records or using them as exemplars that anchor the hunt.\n9. Assigning severity to `needs_validation` records.\n10. Writing the report before independent verification or letting prose and JSON disagree.\n",{"name":5,"group":21,"description":7,"argument-hint":42,"disable-model-invocation":43},"[guide|audit] [path]",true,"main","2b53465943af2bdffb61667ba9c3377a2ea8e649","agent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit",2,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes","https:\u002F\u002Fgithub.com\u002Frubakas","https:\u002F\u002Frubakas.com","2026-11-04 06:46:55",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":43},[54,57,60],{"tool":55,"command":56},"npx","npx skills add rubakas\u002Fagent-notes --skill security-audit",{"tool":58,"command":59},"bunx","bunx skills add rubakas\u002Fagent-notes --skill security-audit",{"tool":61,"command":62},"pnpm","pnpm dlx skills add rubakas\u002Fagent-notes --skill security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",[65,71,75,79,83,87,91,95,99,103,107,111,115,119,123,129,133,137,141],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"AI-AND-LLM.md","REFERENCE","参考文档",10617,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FAI-AND-LLM.md",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"ATTACK-CLASSES.md",16324,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FATTACK-CLASSES.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"CLIENT-SIDE.md",8594,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FCLIENT-SIDE.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"CLOUD-AND-DEPLOYMENT.md",8291,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FCLOUD-AND-DEPLOYMENT.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"DATA-ISOLATION-AND-LIFECYCLE.md",7798,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FDATA-ISOLATION-AND-LIFECYCLE.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"DESKTOP-MOBILE-AND-LOCAL-IPC.md",8739,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FDESKTOP-MOBILE-AND-LOCAL-IPC.md",{"path":92,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":93,"sourceHtmlUrl":94},"HUNTING.md",22261,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FHUNTING.md",{"path":96,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":97,"sourceHtmlUrl":98},"MEMORY-SAFETY-AND-BINARY.md",11186,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FMEMORY-SAFETY-AND-BINARY.md",{"path":100,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":101,"sourceHtmlUrl":102},"PLANNING.md",7472,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FPLANNING.md",{"path":104,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":105,"sourceHtmlUrl":106},"PROTOCOLS-RPC-AND-MESSAGING.md",7483,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FPROTOCOLS-RPC-AND-MESSAGING.md",{"path":108,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":109,"sourceHtmlUrl":110},"RECONNAISSANCE.md",16128,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FRECONNAISSANCE.md",{"path":112,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":113,"sourceHtmlUrl":114},"report-schema.json",14494,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002Freport-schema.json",{"path":116,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":117,"sourceHtmlUrl":118},"RESOURCE-EXHAUSTION-AND-AVAILABILITY.md",7476,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FRESOURCE-EXHAUSTION-AND-AVAILABILITY.md",{"path":120,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":121,"sourceHtmlUrl":122},"SUPPLY-CHAIN-AND-RELEASE.md",7258,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FSUPPLY-CHAIN-AND-RELEASE.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"validate-coverage-ledger.cjs","SCRIPT","脚本",33522,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002Fvalidate-coverage-ledger.cjs",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"validate-findings.cjs",28806,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002Fvalidate-findings.cjs",{"path":134,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":135,"sourceHtmlUrl":136},"VALIDATION-AND-REPORTING.md",16085,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FVALIDATION-AND-REPORTING.md",{"path":138,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":139,"sourceHtmlUrl":140},"WEB-PROTOCOL-AND-AUTH.md",12921,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FWEB-PROTOCOL-AND-AUTH.md",{"path":142,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":143,"sourceHtmlUrl":144},"WRITE-ISOLATION.md",2182,"https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsecurity-audit\u002FWRITE-ISOLATION.md",[146,168,183,194,210,231],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":37},"01M6C4XHM2B03ZDXCSGE2MARZQ","wayfinder","Charts a map of investigation tickets on the issue tracker for work too big for one agent session, then resolves them one per session. Use when the user wants to wayfind a large loose idea or continue an existing wayfinder map.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fwayfinder\u002FSKILL.md",[],[148,153,154,21,155,156,23,157,25,158,29,159,160,161,162,163,164,165,166,167],"investigation","work","session","Charts","continue","map","Existing","number","URL","tracker","tickets","issue","issue tracker","user","idea",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":37},"01M6C4XFG6NNBQVTV6MHAC6BZW","triage","Triages issues and external PRs: categorises, verifies, grills if needed, and writes agent-ready briefs. Use when the user wants to triage the backlog or a specific issue or PR.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Ftriage\u002FSKILL.md",[],[170,175,21,176,177,178,179,180,25,164,181,29,182,166],"ready","issues","pr","backlog","at","prs","look","briefs",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":37},"01M6C4XDMWQ5PM188GBGTAZ0A1","to-tickets","Breaks a plan, spec or conversation into tracer-bullet tickets, each declaring its blocking edges, and publishes them to the configured tracker. Use when the user wants a spec or plan turned into tickets or issues.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fto-tickets\u002FSKILL.md",[],[190,163,191,21,192,166,193,176,25,29,160,161,162,164,24],"to tickets","plan","spec","conversation",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":37},"01M6C4XBXCF4ZN71K05B76YT1F","to-spec","Turns the current conversation into a spec and publishes it to the project issue tracker, with no interview, only synthesis of what was discussed. Use when the user wants the discussion written up as a spec.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fto-spec\u002FSKILL.md",[],[201,192,202,21,166,193,203,204,205,25,206,29,207,162,164,165,208,209,24],"to spec","interview","as","project","up","only","with","it","Synthesis",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":221,"publishedAt":37},"01M6C4X99BG4ENH8GE9AK67902","setup-agent-tracker","Configures a repo's issue tracker, triage label vocabulary and domain doc layout for the agent-notes workflow skills. Use when starting in a new repo, once, before triage, to-spec, to-tickets or wayfinder.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Fsetup-agent-tracker\u002FSKILL.md",[216],{"categoryNo":217,"categoryName":218,"taxonomyType":219,"taxonomyTypeDesc":220},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[222,223,162,21,224,225,170,29,226,23,25,227,228,229,163,192,164,148,165,230],"setup agent tracker","setup","repo","doc","domain","workflow","notes","layout","new repo",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":237,"publishedAt":37},"01M6C4X6SKTTCSQD7ZJHBFCCZB","rsi","Runs a loop that improves existing code (bugs, performance, consistency, tests, DRY) without adding features. Use when the user says 'rsi', or asks to improve, clean up or harden a codebase. For one refactor use refactoring-protocol.","https:\u002F\u002Fgithub.com\u002Frubakas\u002Fagent-notes\u002Fblob\u002Fmain\u002Fagent_notes\u002Fdata\u002Fskills\u002Frsi\u002FSKILL.md",[],[233,21,238,239,205,240,29,241,34,242,243,244,23,245,25,246,159,247,248,22],"refactoring","performance","improve","loop","consistency","bugs","scope","clean","tests","dry","features"]