| name | backdoor-persistence-reviewer |
| description | Review changes for hidden privileged paths, triggers, covert egress, persistence, security-control tampering, and unexplained behavior. |
| version | 1.0.0 |
| since | 2026-08-27 |
| last_modified | 2026-08-27 |
| authors | ["platform-engineering"] |
| stability | stable |
| min_platform_version | {"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"} |
| deprecated_since | null |
| replaces | null |
| supersedes | [] |
| changelog | [{"version":"1.0.0","date":"2026-08-27","change":"Initial generated production-ready SDLC / DevSecOps skill"}] |
Backdoor Persistence Reviewer
Purpose
Review code, configuration, build changes, and generated artifacts for deliberate or unexplained privileged control paths, hidden triggers, covert egress, security-control tampering, and persistence. Require every security-relevant behavior to be traceable to an authorized requirement rather than assuming all weaknesses are accidental.
Goal and behavioral contract
The authoritative Goal and artifact references are defined in descriptor.yaml. Capability boundaries, identity and delegation requirements, tool permissions, data boundaries, invariants, approval requirements, output contract, and operational limits are defined in contract.yaml. MCP/A2A trust boundaries and the reviewed execution closure live in integrations/ and dependencies.yaml; ASPS and assurance requirements live in assurance.yaml.
Treat those declarations as mandatory execution constraints. skcr validates requirements but does not claim verification or enforce them at runtime.
When to use
- AI-generated, externally contributed, obfuscated, security-sensitive, or unexpectedly broad changes need hostile-intent review.
- Authentication, authorization, update, plugin, startup, logging, telemetry, networking, or build behavior changes.
- A diff introduces magic values, undocumented routes, debug paths, dynamic code, remote endpoints, hooks, or platform persistence.
- An incident suggests a hidden trigger, master credential, covert channel, audit suppression, or re-entry mechanism.
- Classic vulnerability review passed but behavioral provenance remains unexplained.
Operating model
- Establish expected behavior from task, specification, Goal, Contract, architecture, tests, and documented operations.
- Trace every new privileged branch, trigger, external interaction, startup action, and security-control change to explicit provenance.
- Review semantic behavior across source, generated output, dependencies, build hooks, installers, configuration, and deployment artifacts.
- Develop trigger hypotheses and validate them with safe static analysis and targeted negative tests.
- Preserve evidence and separate confirmed malicious behavior, suspicious unexplained behavior, accidental vulnerability, and benign documented functionality.
Spec-Driven Change Context
- Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
- For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
