audit-context-building

name	audit-context-building
description	Ultra-granular code analysis for deep architectural context building. Line-by-line and block-by-block analysis using First Principles, 5 Whys, 5 Hows methodology at micro scale. Builds mental models, tracks invariants and assumptions, and maps cross-function call flows for security audit preparation.
version	1.2.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Glob","Grep","Bash","Write"]
args	<target-path> [--depth deep|standard] [--focus security|architecture|correctness]
best_practices	["Always read code line-by-line before forming any conclusions","Track every assumption and invariant explicitly in notes","Build mental models incrementally from concrete code, never from abstractions","Map cross-function call flows completely before analyzing individual functions","Document what the code ACTUALLY does, not what comments say it does"]
error_handling	graceful
streaming	supported
agents	["security-architect","code-reviewer","developer"]
verified	true
lastVerifiedAt	"2026-03-01T00:00:00.000Z"
source	builtin
trust_score	100
provenance_sha	d501e2508e0a2fa2

Audit Context Building Skill

Ultra-granular code analysis skill adapted from Trail of Bits audit methodology. Builds deep architectural context through systematic line-by-line analysis using First Principles, 5 Whys, and 5 Hows at micro scale. Designed for security audit preparation, architectural understanding, and correctness verification. - Line-by-line and block-by-block code analysis - First Principles reasoning at code-level granularity - 5 Whys root cause analysis at micro scale - 5 Hows implementation verification at micro scale - Mental model building from concrete code paths - Invariant and assumption tracking across functions - Cross-function call flow mapping and analysis - State transition identification and verification - Trust boundary identification and classification - Data flow tracking through function boundaries - Anti-hallucination enforcement: conclusions from code only

Overview

This skill implements Trail of Bits' audit context building methodology for the agent-studio framework. The core principle is: never form conclusions about code without reading it line by line first. This skill systematically builds understanding from the ground up, tracking every assumption, invariant, and data flow explicitly.

Source repository: https://github.com/trailofbits/skills License: CC-BY-SA-4.0 Methodology: First Principles + 5 Whys + 5 Hows at micro scale

When to Use

• Before security audits to build deep codebase understanding
• When analyzing unfamiliar codebases for architectural review
• When debugging complex cross-function interactions
• When verifying correctness of critical code paths (auth, crypto, state machines)
• When preparing for threat modeling with concrete code evidence
• When onboarding to a new codebase section that handles sensitive operations

Iron Laws

1. NEVER form conclusions without line-by-line evidence — every claim about code behavior MUST be backed by specific line references; if you have not read the code, you do not know what it does.
2. NEVER trust comments over actual code — comments describe intent, code describes behavior; when they conflict, the code is authoritative; always verify what comments claim.
3. NEVER skip error handling paths — error paths frequently contain security-relevant behavior (fallback auth, leaked stack traces, privilege bypass) that is invisible to happy-path analysis.
4. ALWAYS map cross-function call flows before analyzing individual functions — isolated function analysis misses inter-function trust assumptions; understand the full call chain first.
5. — an unverified assumption is an unexamined risk; mark every assumption with and track it until confirmed or disproven.