메뉴
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.
| name | audit-context-building |
| description | Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/audit-context-building |
Goal — produce reports/00-context.md that answers:
tokei / cloc / file)?main, bin, scripts.start, exported
library surface, CLI subcommands, HTTP routes, CI workflows?postinstall,
preinstall, setup.py, build.rs, Makefile targets)?git log --format='%an' | sort -u | head)?
When was the last commit? Any rewritten history?# All commands are READ-ONLY — safe on target/.
find target -maxdepth 3 -name 'package.json' -o -name 'pyproject.toml' \
-o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'pom.xml' \
-o -name 'build.gradle*' -o -name 'composer.json' -o -name 'Gemfile'
git -C target log --oneline --all | head -50
git -C target shortlog -sne | head -20
# URLs & network endpoints
grep -rEn "https?://|wss?://|ssh://|git\+" target --include='*.{js,ts,py,go,rs,json,yaml,yml,toml,md}' | head -100
Write reports/00-context.md:
# Audit context — <target name> @ <commit>
## Languages
| Language | Files | LOC |
|---|---|---|
| TypeScript | 142 | 18,904 |
## Package managers
- npm (package-lock.json v3) — 812 deps (direct: 47)
- pip (requirements.txt) — 23 deps
## Entry points
- HTTP: `src/server.ts:42` — Express, routes mounted in `src/routes/*.ts`
- CLI: `bin/cli.js`
- Library: `exports` in `package.json`
## Install-time hooks (⚠ high risk)
- `package.json` scripts.postinstall → `node scripts/setup.js`
- `Cargo.toml` build.rs present
## Contributors / history
- 3 authors, last commit 2026-03-14, force-push detected (see §…)
## Network endpoints referenced
- telemetry.example.com
- raw.githubusercontent.com/<user>/<repo>
git+ssh:// or github:user/repo#commit deps pointing outside known orgs.npmrc / .yarnrc pointing to non-public registries