BaaRai b81c6238a7 feat: codeaudit skill (white-box source audit pipeline) ...

ARTEX hunts live targets well but has no methodology for auditing source
code handed to it (a plugin, an application, a repository). White-box
audits so far ran on ad-hoc task goals with no shared procedure.

Adds skills/codeaudit/SKILL.md, distilled from VulnHunter's methodology
(Apache-2.0) and adapted to ARTEX mechanics (work dir artifacts, facts,
report_finding, the standing quality and adversarial gates):

- production-code-only scope rules, with the checked-in infra-config
  exception (reverse proxy / trust / CORS directives are in scope)
- phase 1: every user-controllable input inventoried with dispositions,
  codebase partitioning, shared defense catalog
- phase 2: attacker-first forward tracing per vuln class, with the
  investigation discipline (never stop at abstraction boundaries, audit
  all parameters at outbound call sites, exhaust all paths, follow
  through stores and responses, transitive caller search on sinks)
- three gates (reachable, attacker-controlled, new capability), comment
  skepticism, sanitizer scope mismatch, anti-merge
- PoC preference order (executed against a local instance beats static
  trace; static PoCs carry entry value, file:line chain, sink literal,
  impact), measured impact per the standing gates
- sweep with per-instance dispositions and a count cross-check that
  forbids silent drops

Also fixes the shipped scopesentry skill, which the new guard test
caught immediately: its frontmatter block was never closed and its name
did not match its directory, so the whole file failed frontmatter
parsing and silently degraded to an empty description (the skill has
been undiscoverable). The new server test parses every shipped skill
with the real parser and fails on any skill LoadDir cannot read or that
ends with an empty description.

2026-10-12 06:41:22 +02:00

..

SKILL.md

feat: codeaudit skill (white-box source audit pipeline)

2026-10-12 06:41:22 +02:00