Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

audit-context-building

Étoiles2

Forks0

Mis à jour20 avril 2026 à 19:28

Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

rasata

rasata/coldvault.dev

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	audit-context-building
description	Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
license	MIT (ZONOVA RESEARCH — coldvault.dev)
source_inspiration	trailofbits/skills/audit-context-building

audit-context-building

Goal — produce reports/00-context.md that answers:

What languages are present (LOC per language via tokei / cloc / file)?
What package managers / lockfiles exist?
What is the declared entry point(s) — main, bin, scripts.start, exported library surface, CLI subcommands, HTTP routes, CI workflows?
What is the build system? What runs at install time (postinstall, preinstall, setup.py, build.rs, Makefile targets)?
Who are the top contributors (git log --format='%an' | sort -u | head)? When was the last commit? Any rewritten history?
What external services does it talk to (grep for URLs, domains, S3 buckets, webhook endpoints, hardcoded IPs)?

Procedure

# All commands are READ-ONLY — safe on target/.
find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \
     -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \
     -o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile'

git -C target log --oneline --all | head -50
git -C target shortlog -sne | head -20

# URLs & network endpoints
grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100

Output

Write reports/00-context.md:

# Audit context — <target name> @ <commit>

## Languages
| Language | Files | LOC |
|---|---|---|
| TypeScript | 142 | 18,904 |

## Package managers
- npm (package-lock.json v3) — 812 deps (direct: 47)
- pip (requirements.txt) — 23 deps

## Entry points
- HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts`
- CLI: `bin/cli.js`
- Library: `exports` in `package.json`

## Install-time hooks (⚠ high risk)
- `package.json` scripts.postinstall → `node scripts/setup.js`
- `Cargo.toml` build.rs present

## Contributors / history
- 3 authors, last commit 2026-03-14, force-push detected (see §…)

## Network endpoints referenced
- telemetry.example.com
- raw.githubusercontent.com/<user>/<repo>

Red flags to surface immediately

Install-time scripts that execute code
git+ssh:// or github:user/repo#commit deps pointing outside known orgs
Minified / obfuscated source checked in
.npmrc / .yarnrc pointing to non-public registries
Recent force-pushes (history rewriting)
Single-author repos with no test suite

Plus depuis ce dépôt

même dépôt

defensive-payload-analysis

rasata/coldvault.dev

Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).

2026-04-212

html-report-renderer

rasata/coldvault.dev

Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.

2026-04-212

agentic-actions-auditor

rasata/coldvault.dev

Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).

2026-04-202

constant-time-analysis

rasata/coldvault.dev

Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.

2026-04-202

entry-point-analyzer

rasata/coldvault.dev

Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.

2026-04-202

insecure-defaults-hunter

rasata/coldvault.dev

Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.

2026-04-202

audit-context-building

Goal — produce reports/00-context.md that answers:

What languages are present (LOC per language via tokei / cloc / file)?

What package managers / lockfiles exist?

What is the declared entry point(s) — main, bin, scripts.start, exported library surface, CLI subcommands, HTTP routes, CI workflows?

What is the build system? What runs at install time (postinstall, preinstall, setup.py, build.rs, Makefile targets)?

Who are the top contributors (git log --format='%an' | sort -u | head)? When was the last commit? Any rewritten history?

What external services does it talk to (grep for URLs, domains, S3 buckets, webhook endpoints, hardcoded IPs)?

Procedure

# All commands are READ-ONLY — safe on target/. find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \ -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \ -o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile' git -C target log --oneline --all | head -50 git -C target shortlog -sne | head -20 # URLs & network endpoints grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100

Output

Write reports/00-context.md:

# Audit context — <target name> @ <commit> ## Languages | Language | Files | LOC | |---|---|---| | TypeScript | 142 | 18,904 | ## Package managers - npm (package-lock.json v3) — 812 deps (direct: 47) - pip (requirements.txt) — 23 deps ## Entry points - HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts` - CLI: `bin/cli.js` - Library: `exports` in `package.json` ## Install-time hooks (⚠ high risk) - `package.json` scripts.postinstall → `node scripts/setup.js` - `Cargo.toml` build.rs present ## Contributors / history - 3 authors, last commit 2026-03-14, force-push detected (see §…) ## Network endpoints referenced - telemetry.example.com - raw.githubusercontent.com/<user>/<repo>

Red flags to surface immediately

Install-time scripts that execute code

git+ssh:// or github:user/repo#commit deps pointing outside known orgs

Minified / obfuscated source checked in

.npmrc / .yarnrc pointing to non-public registries

Recent force-pushes (history rewriting)

Single-author repos with no test suite