domains / security / audit-context-building / audit-context-building

audit-context-building

Skill card

combined

The two copies describe the same pre-audit phase but enforce it in incompatible ways. The trailofbits copy is a routing skill: it explicitly forbids doing the analysis in the current context and requires dispatching subagents to write files, returning only compact records. The sickn33 copy is a behavioral skill: it instructs the agent to perform ultra-granular, line-by-line analysis in the current context using specific heuristics (5 Whys, 5 Hows) and a detailed checklist. Because one copy mandates delegation to avoid context bloat while the other mandates direct, deep analysis, crowning one would hide a real alternative approach to the same task.

Repositories

Other copies

Combined skill

# Audit Context Building

Build understanding, not verdicts. This phase runs before vulnerability hunting.

## When to Use
- Starting an audit, threat model, or architecture review on unfamiliar code.
- When previous findings are hard to judge due to lack of system mapping.

## When NOT to Use
- Do not name vulnerabilities, suggest fixes, or rate severity.
- Do not use on code you already understand.

## Execution Strategy
Choose one of the following strategies based on context constraints:

### Strategy A: Delegated Analysis (Context Preservation)
Use when the codebase is large or context window is limited.
1. Dispatch a subagent to analyze the codebase or specific functions.
2. The subagent writes detailed records to `audit-context/DOSSIER.md` and `audit-context/functions/`.
3. Return only compact records: index, unenforced assumptions, and open questions.
4. Read function files only when detail is needed.

### Strategy B: Direct Ultra-Granular Analysis (Deep Dive)
Use when deep, immediate understanding is required and context allows.
1. **Orientation:** Identify modules, entrypoints, actors, and key state variables.
2. **Micro-Analysis:** For each non-trivial function:
   - Define Purpose, Inputs/Assumptions, and Outputs/Effects.
   - Perform block-by-block analysis applying First Principles, 5 Whys, and 5 Hows.
   - Track invariants and assumptions per block.
3. **Cross-Function Flow:**
   - Jump into callees immediately.
   - Treat external calls with available code as internal.
   - Treat black-box external calls as adversarial (consider reverts, bad returns, reentrancy).
   - Maintain continuity of invariants across the call chain.
4. **Output:** Structure findings using a consistent format (Purpose, Assumptions, Invariants, Open Questions).

## Key Rules
- **Follow the Calls:** Correctness often depends on callee behavior. Read the callee, not just the caller.
- **Explicit Uncertainty:** If an assumption is not enforced, mark it `nothing found`. Do not guess.
- **Open Questions:** Carry forward unclear points rather than forcing confident answers.
- **Citations:** Every claim should cite a line or become an open question.