alpha-omega-security/scrutineer

verify

Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.

critic

Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.

disclose

Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them…

public-issue

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation. Use for hardening gaps, defence-in-depth misses, and other bugs that do not warrant coordinated private disclosure.

report-upstream

File a finding on the upstream repository through GitHub's private vulnerability reporting, request the temporary private fork, and push the proposed patch to it when available. Use after disclose has produced a draft and (optionally) patch has produced a…

security-deep-dive

Audit first-party source for security vulnerabilities using an inventory-first, six-step per-sink methodology. Use when you want a thorough scan that distinguishes real findings from pattern matches and records both in a machine-readable report. The target is…

audit-memory

Focused static audit for reachable memory corruption in first-party C, C++, unsafe Rust, native extensions, and FFI boundaries.

embedded-native

Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized. Runs when triage finds native-extension, submodule, or mixed native-language signals.

threat-model

Derive a project's security contract from its source and docs, then emit it as structured data other skills can cite. Records what the project assumes about callers and inputs, what properties it claims and disclaims, which code is out of scope, and which…

vuln-scan

High-recall static source-code vulnerability scan adapted from Anthropic's defending-code reference harness. Fans out by focus area, ranks candidates by confidence, and emits Scrutineer findings for later verification.

triage

Default pipeline scrutineer runs when a repository is added. Triggers a standard set of other skills in parallel, then writes a short summary of what was enqueued. Edit the list below to change the default scan coverage without touching scrutineer's Go code.

security-deep-dive-short

Eval-only short-prompt variant of security-deep-dive for A/B testing against the production prompt. Not loaded as a bundled production skill.

packages

Look up every package this repository publishes across all registries via packages.ecosyste.ms, with downloads, dependent counts, latest version, registry URL and supply-chain risk flags.

patch

Propose a code patch for a finding. Produces a unified diff against the scanned ref plus a short rationale; a diff that passes the worker's applicability gate is stored on the finding as its suggested fix, and a summary note is posted for analyst review. The…

reattack

Independently re-attack one immutable proposed patch with root-cause variants and a benign control. Records whether the patch resisted the attack, was bypassed at the same sink, or could not be evaluated conclusively.

recon

Map distinct externally reachable input-processing subsystems into focus areas for the threat-model skill to carry into later security audits. This is a short, read-only orientation pass, not a vulnerability scan.

advisory-deep-dive

Re-audit every past GHSA/CVE advisory published against this repository, anchored on each advisory's fix commit, for four failure modes, a regression of the original bug, a bypass of the fix, an incomplete fix that left a path open, and the same class of bug…

history

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

zizmor

Audit GitHub Actions workflows with zizmor and explain reported hits using bundled trust-boundary references.

dependencies

Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.

audit-pii

Focused static audit for real personal or customer-identifying data committed to source or exposed through logs, URLs, telemetry, exports, and responses.

maintainers

Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a…

repo-overview

Run `brief --json` to produce a structured overview of the repository. Used by other skills as orientation.

advisories

Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms.

metadata

Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row.

audit-authz

Focused static audit for IDOR, tenant-isolation failures, missing or fail-open authorization guards, privilege escalation, and unverified claims used for access decisions.

audit-exfil

Focused static audit for attacker-controlled reads, requests, parsers, or error paths that can disclose files, metadata, secrets, or internal responses.

audit-injection

Focused static audit for attacker-controlled data reaching command execution, dynamic evaluation, unsafe deserialization, or server-side template execution.

revalidate

Cheap finding classifier. Reads a finding's six-step trace plus git history at its location and decides true_positive, false_positive, already_fixed, or uncertain, with an optional adjusted severity. Read-only; never executes the reproduction. Run…

variants

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

forensics

Build a read-only compromise timeline and evidence bundle from local Git history and public forge/archive records. Use after suspected maintainer, account, release, or source-history compromise; it produces evidence, not findings or remediation.

finding-dedup

Compare open findings in one repository and record how they relate. Marks same-vulnerability findings as duplicates, findings that another finding's fix will close as subsumed, and findings that combine into a higher-severity attack as a chain.

semgrep

Run semgrep's `p/security-audit` and `p/secrets` rulesets and map hits into the findings shape.

reachability

Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and…

breaking-change

Decide whether a finding's suggested fix is a breaking change for top dependents. Reads the unified-diff fix on the finding, identifies the public API surface that changes (signatures, exports, removed fields, renamed types), and lists which top dependents…

cna-match

Match the repository to a CVE Numbering Authority so disclosures route to the CNA's security contact when one covers the repo.

exposure

For one (finding, dependent) pair, decide whether the dependent's code reaches the upstream finding. Emits a CSAF 2.0 product_status verdict with VEX justification.

ingest

Normalize an externally-produced security report in an arbitrary format into scrutineer findings. The raw report is staged at import/report by the /v1/import fallback; read it, extract each distinct finding, resolve locations against the checkout, and write…

mitigate

Draft operational mitigations for a finding consumers can apply before a fix ships. Workarounds (config flags, input restrictions, safe defaults), detection guidance (what to log and what pattern to alert on), and optionally a semgrep rule that flags the same…

posture

Assess a repository's security posture and its readiness to receive a vulnerability report. Checks for a security policy, private vulnerability reporting, security.txt, prior advisories, scanning workflows, and other hygiene signals, then rates the project…