daishir0/sec-audit/skill

sec-audit — multi-lens static security audit

One audit pass misses things. This skill audits the same code through several lenses that have different blind spots, keeps the lens results independent, merges them into a union list, and uses how often each weakness was re-found across lenses to estimate how many are still unseen.

Recommended: the runner (same procedure for Claude Code and Codex)

python runner/run_audit.py --target <code dir or .zip/.tar.gz> --out <run dir> --agent claude   # or: --agent codex

Each step is a separate non-interactive CLI process with a fixed prompt from prompts/; lenses run one at a time and cannot see each other's output. Results: <run dir>/.sec-audit/final/ (findings, incidence matrices, metrics.json) and <run dir>/.sec-audit/provenance.json (agent, model, CLI version, prompt and lens hashes, input hash, timings, token usage per step).

Interactive use (inside Claude Code or Codex)

When invoked directly, follow the same steps yourself, in order, using the prompt texts in prompts/ with {{CODE_DIR}} = the code root, {{SKILL_DIR}} = this skill's directory and output under .sec-audit/:

1. prompts/recon.md → .sec-audit/recon.md
2. For each lens in lenses.json, one at a time, prompts/lens.md (in Claude

Code, delegate each lens to the lens-auditor sub-agent so its context is isolated; never let a lens read another lens's output).

1. prompts/consolidate.md → .sec-audit/final/findings/ and merge-map.tsv
2. python scripts/incidence.py <workspace> → incidence matrices and metrics.json
3. Optionally prompts/report.md → reports.

Rules

• Static review only: never run the target application or its code.
• Read the real code before writing a finding; cite path:line relative to the code root; never write absolute paths.
• Do not collapse the lenses into one sweep: the completeness estimate depends on independent, diverse lenses.
• The completeness numbers are estimates under an independence assumption, not guarantees; report them with their intervals.