Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

audit-context-building

Estrellas2

Forks0

Actualizado20 de abril de 2026, 19:28

Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

rasata

rasata/coldvault.dev

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	audit-context-building
description	Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
license	MIT (ZONOVA RESEARCH — coldvault.dev)
source_inspiration	trailofbits/skills/audit-context-building

audit-context-building

Goal — produce reports/00-context.md that answers:

What languages are present (LOC per language via tokei / cloc / file)?
What package managers / lockfiles exist?
What is the declared entry point(s) — main, bin, scripts.start, exported library surface, CLI subcommands, HTTP routes, CI workflows?
What is the build system? What runs at install time (postinstall, preinstall, setup.py, build.rs, Makefile targets)?
Who are the top contributors (git log --format='%an' | sort -u | head)? When was the last commit? Any rewritten history?
What external services does it talk to (grep for URLs, domains, S3 buckets, webhook endpoints, hardcoded IPs)?

Procedure

# All commands are READ-ONLY — safe on target/.
find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \
     -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \
     -o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile'

git -C target log --oneline --all | head -50
git -C target shortlog -sne | head -20

# URLs & network endpoints
grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100

Output

Write reports/00-context.md:

# Audit context — <target name> @ <commit>

## Languages
| Language | Files | LOC |
|---|---|---|
| TypeScript | 142 | 18,904 |

## Package managers
- npm (package-lock.json v3) — 812 deps (direct: 47)
- pip (requirements.txt) — 23 deps

## Entry points
- HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts`
- CLI: `bin/cli.js`
- Library: `exports` in `package.json`

## Install-time hooks (⚠ high risk)
- `package.json` scripts.postinstall → `node scripts/setup.js`
- `Cargo.toml` build.rs present

## Contributors / history
- 3 authors, last commit 2026-03-14, force-push detected (see §…)

## Network endpoints referenced
- telemetry.example.com
- raw.githubusercontent.com/<user>/<repo>

Red flags to surface immediately

Install-time scripts that execute code
git+ssh:// or github:user/repo#commit deps pointing outside known orgs
Minified / obfuscated source checked in
.npmrc / .yarnrc pointing to non-public registries
Recent force-pushes (history rewriting)
Single-author repos with no test suite

Más de este repositorio

mismo repositorio

defensive-payload-analysis

rasata/coldvault.dev

Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).

2026-04-212

html-report-renderer

rasata/coldvault.dev

Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.

2026-04-212

agentic-actions-auditor

rasata/coldvault.dev

Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).

2026-04-202

constant-time-analysis

rasata/coldvault.dev

Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.

2026-04-202

entry-point-analyzer

rasata/coldvault.dev

Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.

2026-04-202

insecure-defaults-hunter

rasata/coldvault.dev

Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.

2026-04-202

audit-context-building

Goal — produce reports/00-context.md that answers:

What languages are present (LOC per language via tokei / cloc / file)?

What package managers / lockfiles exist?

What is the declared entry point(s) — main, bin, scripts.start, exported library surface, CLI subcommands, HTTP routes, CI workflows?

What is the build system? What runs at install time (postinstall, preinstall, setup.py, build.rs, Makefile targets)?

Who are the top contributors (git log --format='%an' | sort -u | head)? When was the last commit? Any rewritten history?

What external services does it talk to (grep for URLs, domains, S3 buckets, webhook endpoints, hardcoded IPs)?

Procedure

# All commands are READ-ONLY — safe on target/. find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \ -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \ -o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile' git -C target log --oneline --all | head -50 git -C target shortlog -sne | head -20 # URLs & network endpoints grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100

Output

Write reports/00-context.md:

# Audit context — <target name> @ <commit> ## Languages | Language | Files | LOC | |---|---|---| | TypeScript | 142 | 18,904 | ## Package managers - npm (package-lock.json v3) — 812 deps (direct: 47) - pip (requirements.txt) — 23 deps ## Entry points - HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts` - CLI: `bin/cli.js` - Library: `exports` in `package.json` ## Install-time hooks (⚠ high risk) - `package.json` scripts.postinstall → `node scripts/setup.js` - `Cargo.toml` build.rs present ## Contributors / history - 3 authors, last commit 2026-03-14, force-push detected (see §…) ## Network endpoints referenced - telemetry.example.com - raw.githubusercontent.com/<user>/<repo>

Red flags to surface immediately

Install-time scripts that execute code

git+ssh:// or github:user/repo#commit deps pointing outside known orgs

Minified / obfuscated source checked in

.npmrc / .yarnrc pointing to non-public registries

Recent force-pushes (history rewriting)

Single-author repos with no test suite