alpha-omega-security/scrutineer

verify

Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.

Idioma del texto original: inglés

critic

Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.

Idioma del texto original: inglés

disclose

Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them…

Idioma del texto original: inglés

public-issue

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation. Use for hardening gaps, defence-in-depth misses, and other bugs that do not warrant coordinated private disclosure.

Idioma del texto original: inglés

report-upstream

File a finding on the upstream repository through GitHub's private vulnerability reporting, request the temporary private fork, and push the proposed patch to it when available. Use after disclose has produced a draft and (optionally) patch has produced a…

Idioma del texto original: inglés

security-deep-dive

Audit first-party source for security vulnerabilities using an inventory-first, six-step per-sink methodology. Use when you want a thorough scan that distinguishes real findings from pattern matches and records both in a machine-readable report. The target is…

Idioma del texto original: inglés

audit-memory

Focused static audit for reachable memory corruption in first-party C, C++, unsafe Rust, native extensions, and FFI boundaries.

Idioma del texto original: inglés

embedded-native

Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized. Runs when triage finds native-extension, submodule, or mixed native-language signals.

Idioma del texto original: inglés

threat-model

Derive a project's security contract from its source and docs, then emit it as structured data other skills can cite. Records what the project assumes about callers and inputs, what properties it claims and disclaims, which code is out of scope, and which…

Idioma del texto original: inglés

vuln-scan

High-recall static source-code vulnerability scan adapted from Anthropic's defending-code reference harness. Fans out by focus area, ranks candidates by confidence, and emits Scrutineer findings for later verification.

Idioma del texto original: inglés

triage

Default pipeline scrutineer runs when a repository is added. Triggers a standard set of other skills in parallel, then writes a short summary of what was enqueued. Edit the list below to change the default scan coverage without touching scrutineer's Go code.

Idioma del texto original: inglés

security-deep-dive-short

Eval-only short-prompt variant of security-deep-dive for A/B testing against the production prompt. Not loaded as a bundled production skill.

Idioma del texto original: inglés

packages

Look up every package this repository publishes across all registries via packages.ecosyste.ms, with downloads, dependent counts, latest version, registry URL and supply-chain risk flags.

Idioma del texto original: inglés

patch

Propose a code patch for a finding. Produces a unified diff against the scanned ref plus a short rationale; a diff that passes the worker's applicability gate is stored on the finding as its suggested fix, and a summary note is posted for analyst review. The…

Idioma del texto original: inglés

reattack

Independently re-attack one immutable proposed patch with root-cause variants and a benign control. Records whether the patch resisted the attack, was bypassed at the same sink, or could not be evaluated conclusively.

Idioma del texto original: inglés

recon

Map distinct externally reachable input-processing subsystems into focus areas for the threat-model skill to carry into later security audits. This is a short, read-only orientation pass, not a vulnerability scan.

Idioma del texto original: inglés

advisory-deep-dive

Re-audit every past GHSA/CVE advisory published against this repository, anchored on each advisory's fix commit, for four failure modes, a regression of the original bug, a bypass of the fix, an incomplete fix that left a path open, and the same class of bug…

Idioma del texto original: inglés

history

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

Idioma del texto original: inglés

zizmor

Audit GitHub Actions workflows with zizmor and explain reported hits using bundled trust-boundary references.

Idioma del texto original: inglés

dependencies

Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.

Idioma del texto original: inglés

audit-pii

Focused static audit for real personal or customer-identifying data committed to source or exposed through logs, URLs, telemetry, exports, and responses.

Idioma del texto original: inglés

maintainers

Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a…

Idioma del texto original: inglés

repo-overview

Run `brief --json` to produce a structured overview of the repository. Used by other skills as orientation.

Idioma del texto original: inglés

advisories

Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms.

Idioma del texto original: inglés

metadata

Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row.

Idioma del texto original: inglés

audit-authz

Focused static audit for IDOR, tenant-isolation failures, missing or fail-open authorization guards, privilege escalation, and unverified claims used for access decisions.

Idioma del texto original: inglés

audit-exfil

Focused static audit for attacker-controlled reads, requests, parsers, or error paths that can disclose files, metadata, secrets, or internal responses.

Idioma del texto original: inglés

audit-injection

Focused static audit for attacker-controlled data reaching command execution, dynamic evaluation, unsafe deserialization, or server-side template execution.

Idioma del texto original: inglés

revalidate

Cheap finding classifier. Reads a finding's six-step trace plus git history at its location and decides true_positive, false_positive, already_fixed, or uncertain, with an optional adjusted severity. Read-only; never executes the reproduction. Run…

Idioma del texto original: inglés

variants

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

Idioma del texto original: inglés

forensics

Build a read-only compromise timeline and evidence bundle from local Git history and public forge/archive records. Use after suspected maintainer, account, release, or source-history compromise; it produces evidence, not findings or remediation.

Idioma del texto original: inglés

finding-dedup

Compare open findings in one repository and record how they relate. Marks same-vulnerability findings as duplicates, findings that another finding's fix will close as subsumed, and findings that combine into a higher-severity attack as a chain.

Idioma del texto original: inglés

semgrep

Run semgrep's `p/security-audit` and `p/secrets` rulesets and map hits into the findings shape.

Idioma del texto original: inglés

reachability

Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and…

Idioma del texto original: inglés

breaking-change

Decide whether a finding's suggested fix is a breaking change for top dependents. Reads the unified-diff fix on the finding, identifies the public API surface that changes (signatures, exports, removed fields, renamed types), and lists which top dependents…

Idioma del texto original: inglés

cna-match

Match the repository to a CVE Numbering Authority so disclosures route to the CNA's security contact when one covers the repo.

Idioma del texto original: inglés

exposure

For one (finding, dependent) pair, decide whether the dependent's code reaches the upstream finding. Emits a CSAF 2.0 product_status verdict with VEX justification.

Idioma del texto original: inglés

ingest

Normalize an externally-produced security report in an arbitrary format into scrutineer findings. The raw report is staged at import/report by the /v1/import fallback; read it, extract each distinct finding, resolve locations against the checkout, and write…

Idioma del texto original: inglés

mitigate

Draft operational mitigations for a finding consumers can apply before a fix ships. Workarounds (config flags, input restrictions, safe defaults), detection guidance (what to log and what pattern to alert on), and optionally a semgrep rule that flags the same…

Idioma del texto original: inglés

posture

Assess a repository's security posture and its readiness to receive a vulnerability report. Checks for a security policy, private vulnerability reporting, security.txt, prior advisories, scanning workflows, and other hygiene signals, then rates the project…

Idioma del texto original: inglés