agentleFS
Sign inStart free
jahongashtamcjahongashtamc/hallwright/.agents/skills/audit-context-building/SKILL.md

audit-context-building

Skill1 starsChanged 13 days agoMITView on GitHub

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.

We split this skill into the rules it gives an agent

2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 7 edited versions we read keep these.

  • 2

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Never trust function names or signatures: Read the implementation line by line to discover real behavior.

    line 20
  2. Distinctive:

    Catalog Unchecked Invariants: If a function expects a non-null pointer, sanitized input, or authorized session, but never verifies it, …

    line 21

“Common” is measured: kept by at least 6 in 10 of the 7 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Audit Context Building (Trail of Bits Methodology)

Build understanding, not verdicts. This runs before anyone hunts for bugs, and feeds that work.

When to Use

At the start of an audit, a threat model, or an architecture review, when the code is unfamiliar. Also when an earlier pass produced findings nobody could judge, because no one had mapped out how the system fits together.

When NOT to Use

Do not name vulnerabilities, suggest fixes, write proofs-of-concept, or rate severity. Those belong to the hunting phase, which runs next and with the whole picture in hand. When the code counts on something and nothing checks it, record that plainly and move on — whether it matters is decided later.

Core Rules: Follow the Calls

  1. Never trust function names or signatures: Read the implementation line by line to discover real behavior.
  2. Catalog Unchecked Invariants: If a function expects a non-null pointer, sanitized input, or authorized session, but never verifies it, record the missing check.
  3. Map State Transitions: Identify every mutable global, shared memory buffer, or database row modified across call chains.
  4. Identify Blast Radius: List all downstream consumers and upstream callers of modified or critical functions.
  5. Output Structured Dossier:
    • Architecture Summary
    • Component Boundaries & Contracts
    • External Attack Surfaces & Trust Boundaries
    • Unenforced Assumptions Ledger (feeds the vulnerability hunter)

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free