| name | security-audit-phased |
| description | Multi-phase, human-in-the-loop security code audit — Phase 1 reconnaissance, Phase 2 prior-vuln pattern analysis, Phase 3 systematic CWE-taxonomy weakness hunt (including PEACH tenant isolation), Phase 4 cross-cutting analysis and final report, Phase 6 reproducer generation, plus review/CVSS/follow-up-seed helpers. Each phase is a separate slash command that reads the previous phase's JSON and writes its own. |
Phased Security Code Audit
This skill is the interactive, multi-phase counterpart to /secure-code-audit. Where /secure-code-audit runs a single-pass framework-driven assessment and emits a report.schema.json report, the phased workflow walks a reviewer through a codebase in discrete steps with a checkpoint after each — useful for deep-dive audits of a single high-value component where a human wants to steer between phases.
Each phase is invoked as its own slash command and reads/writes JSON under $AUDIT_DIR_NAME/ in the current working directory:
| Command | Phase | Reads | Writes |
|---|
/security-audit-init | P1 Reconnaissance — trust boundaries, privileged ops, data flow, privilege contexts, attack surface, tenant isolation (PEACH) | source, prior-vuln reports, Coverity results | phase1-recon.json |
/security-audit-p2 | P2 Prior-vulnerability pattern analysis | phase1-recon.json, prior-vuln reports | phase2-prior-vulns.json |
/security-audit-p3 | P3 Systematic weakness hunt across the CWE taxonomy (categories 1–8) plus category 9 Tenant Isolation (PEACH) | phase1-recon.json, phase2-prior-vulns.json | phase3-hunt.json |
/security-audit-p4 | P4 Cross-cutting analysis (error paths, concurrency, vuln chains, PEACH escape chains) and final consolidated report | phase{1,2,3}-*.json | phase4-final.json |
/security-audit-p6 | P6 Reproducer generation for accepted findings | phase4-final.json | reproducers |
/security-audit-review | Independent review of a completed final report | phase4-final.json | review notes |
/security-audit-cvss | CVSS v3.1 scoring + Red Hat severity for accepted findings | phase4-final.json | CVSS annotations |
/security-audit-follow-up-seeds | Emit seeds for a follow-up audit run | phase4-final.json | seed list |
Placeholders
The phase prompts reference $AUDIT_DIR_NAME, $RUN_TOKEN, $ARGUMENTS, $SCAN_RESULTS, and $FOCUS. When invoked directly as slash commands, Claude Code substitutes $ARGUMENTS; the remaining placeholders are expected to be substituted by an external driver (or, if left literal, each prompt documents a fallback — e.g. $RUN_TOKEN → generate a random 4-char hex token).
PEACH Tenant Isolation
Phases 1, 3, and 4 embed the PEACH framework (© 2022 Wiz, Inc., licensed CC BY-NC-SA 4.0) for multi-tenant components:
- P1 records
tenant_isolation — whether the component is multi-tenant, and for each customer-facing interface its complexity, shared-vs-duplicated instance, and security-boundary type.
- P3 category 9 hunts for violations of the five hardening parameters (
PEACH-P privilege · PEACH-E encryption · PEACH-A authentication · PEACH-C connectivity · PEACH-H hygiene) against each boundary from P1, applying a tenant → other tenant / control plane trust-boundary gate.
- P4 looks for the cross-tenant escape chain (high-complexity shared interface → weak boundary → unmet PEACH parameter) and rates it by blast radius.
Findings that violate a PEACH parameter carry a peach_references array (["PEACH-C", "PEACH-H"]), matching the field defined in schema/report.schema.json.
Relationship to /secure-code-audit
The phased workflow's phase4-final.json is not a schema/report.schema.json document — it is an intermediate artifact for human review. To publish results into the campaign's analysis-results/findings/ tree, transcribe accepted findings into a <repo>-security-audit.json report per /secure-code-audit and validate with scripts/validate_report.py.
