メニュー
Audit whether an AI agent edit to a file is safe — composes secret-surface, taint-flow, change-impact, and API-surface analysis into an agent-edit safety report. Use before letting an agent modify a sensitive or high-blast-radius file.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | agent-safety-audit |
| description | Audit whether an AI agent edit to a file is safe — composes secret-surface, taint-flow, change-impact, and API-surface analysis into an agent-edit safety report. Use before letting an agent modify a sensitive or high-blast-radius file. |
Produce an agent-edit safety report for a file an autonomous agent is about to (or just did) modify. It answers: does this code touch secrets, carry untrusted data to dangerous sinks, have a large blast radius, or expose a wide API the agent could break? Builds on the change-impact approach but its value is the composition of the four named tools below.
Every dimension is AST/heuristic. secret_surface, taint_flow, and
unsafe-style scans report modeled_kinds; an empty modeled_kinds for the
file's grammar means that dimension is not covered — that is "no evidence,"
NOT "all clear." Read modeled_kinds per call — per the COVERAGE LAW taint (and
the unsafe/secret scans) apply to every applicable tier-1+ grammar, so there
is no fixed "supported" grammar list. A non-empty mask for a dimension means it
was modeled for this grammar (an empty finding is then genuine — e.g. no
source→sink path); an empty/absent mask means that dimension was not
modeled — "no evidence," not "clear," and a coverage gap to close. Always name
the language and the uncovered dimensions. Verdicts are advisory, not a security
guarantee.
Architecture. taint_flow is Architecture; the composed tools enforce their own tiers.
If a tool is rejected for tier, the corresponding dimension is UNAUDITED — say
so rather than implying it passed.
| Step | Tool | What it answers |
|---|---|---|
| 1 | secret_surface | Does the file touch credentials, tokens, signing keys, env-secret reads, or hardcoded secret literals? |
| 2 | taint_flow | Does untrusted input reach a dangerous sink (raw SQL, eval, command exec, fs path, deserialization)? |
| 3 | analyze_impact | What is the change's blast radius — which files transitively depend on the target? |
| 4 | analyze_surface | How wide is the public API at this boundary the agent might break? |
| 5 | scan | Repo-level AI-code threats the per-file tools miss: hardcoded credentials across the tree (pattern + entropy heuristic), .cursorrules/AI-config hidden-Unicode backdoors, MCP-config RCE (CVE-2025-59944), typosquat/hallucinated dependencies, GitHub Actions expression injection, LLM-output-to-exec flows, and prompt-injection surfaces. |
secret_surface on the file. Any CredentialParam / TokenVar /
SigningKey / EnvSecretRead / HardcodedLiteral hit means the agent is
editing secret-adjacent code — flag for human review.taint_flow with target + file. A source→sink path is a hard flag;
note any unresolved tainted-arg callees on the frontier (analysis stopped
there, so downstream is unverified).analyze_impact with the file as target to size the blast radius.
Many transitive dependents → an agent mistake here cascades widely.analyze_surface at the file's boundary. A wide exposed API means more
contract the agent can silently break.scan on the repo (root = repo root). Any ai_config_backdoor,
mcp_config_rce, llm_output_execution, or dependency_hallucination
finding is a hard HUMAN REVIEW flag — these are agent-targeted
supply-chain / injection attacks the per-file dimensions above do not
cover. If the repo has a committed .act/baseline.json, pass
baseline=".act/baseline.json" — the report's baseline section separates
new findings from baselined (acknowledged) repo debt, and for an edit
audit the new partition (IDs in baseline.new_finding_ids) is the signal
that matters. Private repos require the scan entitlement; if absent, mark
this dimension UNAUDITED (never present it as clear).modeled_kinds are non-empty for the
grammar.mcp_config_rce /
ai_config_backdoor finding from scan.taint_flow/secret_surface returned empty modeled_kinds
for this grammar, or a tool was tier-blocked. State which dimension is
uncovered; never present UNAUDITED as SAFE.A per-file safety card: secret hits, taint paths (source → sink, with frontier
notes), blast-radius count, API width, and the verdict. Quote modeled_kinds
and the language for every uncovered dimension.
Execute structural decompositions based on an architectural analysis report. Use when breaking circular dependencies, splitting god classes, reducing coupling between modules, extracting interfaces at seam boundaries, or executing any large-scale structural change identified in an architectural analysis. Requires a prior architecture audit (the architecture-audit skill) that produced project-map.md and a run report.
Use when asked to audit architecture, produce a comprehensive architectural overview, get the full structural picture of a codebase, assess overall health and porting readiness, find module boundaries, circular dependencies, coupling hotspots, dead code, or code patterns. Depth 3 — full audit with hypothesis-driven investigation. Optionally enriches the structural audit with runtime and git evidence (coverage, churn, co-change coupling, ownership) when those overlays are available. Replaces the architectural-analysis and architecture-audit-plus skills.
Use when looking for extraction candidates, planning a module split, analyzing module boundaries, or before decomposing a large component. Also use when asked "where should I split this?" or "find natural module boundaries". Depth 2 — investigate. Produces extraction candidates with cut costs, layer violations, interface width assessment, orphan types, and a recommended decomposition sequence.
Use before modifying a file or symbol, or when asked "what breaks if I change X?". Depth 0 — fast, no follow-up queries, returns immediately. Two modes: inline (no artifacts, default for agent-initiated use) and artifact (writes to docs/act/, triggered for human-initiated requests or Critical risk verdicts).
Traverse large repositories efficiently using act's query tools. Use when exploring unfamiliar code, mapping dependencies, understanding API surfaces, analyzing side effects before modifying functions, or following call chains across files. Avoids reading entire files by querying only the structure needed.
Review code for bugs, complexity, unused symbols, and structural issues using AST-aware analysis. Use when reviewing PRs, checking code quality, finding dead code, analyzing function complexity, auditing a codebase, or checking for type errors. Each call reports the kinds it modeled in `modeled_kinds` — that is the honest coverage signal; the supported-language list is whatever act ships.