القائمة
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | audit-context-building |
| description | Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/audit-context-building |
Goal — produce reports/00-context.md that answers:
tokei / cloc / file)?main, bin, scripts.start, exported
library surface, CLI subcommands, HTTP routes, CI workflows?postinstall,
preinstall, setup.py, build.rs, Makefile targets)?git log --format='%an' | sort -u | head)?
When was the last commit? Any rewritten history?# All commands are READ-ONLY — safe on target/.
find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \
-o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \
-o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile'
git -C target log --oneline --all | head -50
git -C target shortlog -sne | head -20
# URLs & network endpoints
grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100
Write reports/00-context.md:
# Audit context — <target name> @ <commit>
## Languages
| Language | Files | LOC |
|---|---|---|
| TypeScript | 142 | 18,904 |
## Package managers
- npm (package-lock.json v3) — 812 deps (direct: 47)
- pip (requirements.txt) — 23 deps
## Entry points
- HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts`
- CLI: `bin/cli.js`
- Library: `exports` in `package.json`
## Install-time hooks (⚠ high risk)
- `package.json` scripts.postinstall → `node scripts/setup.js`
- `Cargo.toml` build.rs present
## Contributors / history
- 3 authors, last commit 2026-03-14, force-push detected (see §…)
## Network endpoints referenced
- telemetry.example.com
- raw.githubusercontent.com/<user>/<repo>
git+ssh:// or github:user/repo#commit deps pointing outside known orgs.npmrc / .yarnrc pointing to non-public registriesConduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.