ARTEX hunts live targets well but has no methodology for auditing source
code handed to it (a plugin, an application, a repository). White-box
audits so far ran on ad-hoc task goals with no shared procedure.
Adds skills/codeaudit/SKILL.md, distilled from VulnHunter's methodology
(Apache-2.0) and adapted to ARTEX mechanics (work dir artifacts, facts,
report_finding, the standing quality and adversarial gates):
- production-code-only scope rules, with the checked-in infra-config
exception (reverse proxy / trust / CORS directives are in scope)
- phase 1: every user-controllable input inventoried with dispositions,
codebase partitioning, shared defense catalog
- phase 2: attacker-first forward tracing per vuln class, with the
investigation discipline (never stop at abstraction boundaries, audit
all parameters at outbound call sites, exhaust all paths, follow
through stores and responses, transitive caller search on sinks)
- three gates (reachable, attacker-controlled, new capability), comment
skepticism, sanitizer scope mismatch, anti-merge
- PoC preference order (executed against a local instance beats static
trace; static PoCs carry entry value, file:line chain, sink literal,
impact), measured impact per the standing gates
- sweep with per-instance dispositions and a count cross-check that
forbids silent drops
Also fixes the shipped scopesentry skill, which the new guard test
caught immediately: its frontmatter block was never closed and its name
did not match its directory, so the whole file failed frontmatter
parsing and silently degraded to an empty description (the skill has
been undiscoverable). The new server test parses every shipped skill
with the real parser and fails on any skill LoadDir cannot read or that
ends with an empty description.
