spectra-audit

name	spectra-audit
description	Audit changed code for security sharp edges — dangerous defaults, type confusion, and silent failures
effort	xhigh
context	fork
agent	Explore
disallowedTools	["Edit","Write"]
license	MIT
compatibility	Requires spectra CLI.
metadata	{"author":"spectra","version":"1.0","generatedBy":"Spectra"}

Audit changed code for security sharp edges in a Claude Code fork. This generated skill is report-only: it SHALL NOT edit files and SHALL NOT apply fixes directly inside the fork.

Claude fork context

Run git diff HEAD to gather the current changes. If there are no changes, report that no security sharp edges were found and stop.

Analyze the diff through the Scoundrel, Lazy Developer, and Confused Developer lenses. Return a consolidated report with findings grouped by severity, affected files, and recommended fixes. The main thread decides whether to apply any fixes.

---

Core Framework

Three Adversaries

Role	Mindset	Key Questions
Scoundrel	Malicious, deliberate exploitation	Can I disable security via config? Downgrade algorithms? Inject values?
Lazy Developer	Copy-paste, skips docs, deadline pressure	Is the first example safe? Is the default secure? Do errors guide me right?
Confused Developer	Misunderstands usage	Can I swap params silently? Will mistakes fail loudly? Are types distinguishable?

Six Trap Categories

1. Algorithm Choice Traps

Letting developers choose algorithms = inviting them to choose wrong.

# Dangerous: accepts arbitrary algorithm
OpenSSL::Digest.new(algorithm).hexdigest(password)  # algorithm = "md5"?

# Safe: no choice
BCrypt::Password.create(password)  # can't pick wrong

2. Dangerous Defaults

Defaults that are insecure, or zero/empty values that disable security.

# What does timeout=0 mean? Never expire? Expire immediately?
def verify_token(token, timeout: 300)
  return true if timeout ==