alpha-omega-security/scrutineer

verify

Re-run a finding's reproduction against current HEAD, test its attack tree, grade five fixed evidence criteria, and account for every matched design control.

原文语言：英语

critic

Judge whether a validated finding can affect a real release build, and record the attacker position, preconditions, impact, counterevidence, and facts that could change that conclusion. Finding-scoped and read-only.

原文语言：英语

disclose

Draft the disclosure content for a finding in GitHub Security Advisory shape. Produces a title, markdown description, affected package block, CVSS vector, CWE list, references, and a suggested-recipients list from CODEOWNERS or git history, then writes them…

原文语言：英语

public-issue

File a low-severity finding as an ordinary public GitHub issue after explicit analyst confirmation. Use for hardening gaps, defence-in-depth misses, and other bugs that do not warrant coordinated private disclosure.

原文语言：英语

report-upstream

File a finding on the upstream repository through GitHub's private vulnerability reporting, request the temporary private fork, and push the proposed patch to it when available. Use after disclose has produced a draft and (optionally) patch has produced a…

原文语言：英语

security-deep-dive

Audit first-party source for security vulnerabilities using an inventory-first, six-step per-sink methodology. Use when you want a thorough scan that distinguishes real findings from pattern matches and records both in a machine-readable report. The target is…

原文语言：英语

audit-memory

Focused static audit for reachable memory corruption in first-party C, C++, unsafe Rust, native extensions, and FFI boundaries.

原文语言：英语

embedded-native

Map native languages, extension bridges, build tools, manifests, and dependencies after shallow Git submodules have been initialized. Runs when triage finds native-extension, submodule, or mixed native-language signals.

原文语言：英语

threat-model

Derive a project's security contract from its source and docs, then emit it as structured data other skills can cite. Records what the project assumes about callers and inputs, what properties it claims and disclaims, which code is out of scope, and which…

原文语言：英语

vuln-scan

High-recall static source-code vulnerability scan adapted from Anthropic's defending-code reference harness. Fans out by focus area, ranks candidates by confidence, and emits Scrutineer findings for later verification.

原文语言：英语

triage

Default pipeline scrutineer runs when a repository is added. Triggers a standard set of other skills in parallel, then writes a short summary of what was enqueued. Edit the list below to change the default scan coverage without touching scrutineer's Go code.

原文语言：英语

security-deep-dive-short

Eval-only short-prompt variant of security-deep-dive for A/B testing against the production prompt. Not loaded as a bundled production skill.

原文语言：英语

packages

Look up every package this repository publishes across all registries via packages.ecosyste.ms, with downloads, dependent counts, latest version, registry URL and supply-chain risk flags.

原文语言：英语

patch

Propose a code patch for a finding. Produces a unified diff against the scanned ref plus a short rationale; a diff that passes the worker's applicability gate is stored on the finding as its suggested fix, and a summary note is posted for analyst review. The…

原文语言：英语

reattack

Independently re-attack one immutable proposed patch with root-cause variants and a benign control. Records whether the patch resisted the attack, was bypassed at the same sink, or could not be evaluated conclusively.

原文语言：英语

recon

Map distinct externally reachable input-processing subsystems into focus areas for the threat-model skill to carry into later security audits. This is a short, read-only orientation pass, not a vulnerability scan.

原文语言：英语

advisory-deep-dive

Re-audit every past GHSA/CVE advisory published against this repository, anchored on each advisory's fix commit, for four failure modes, a regression of the original bug, a bypass of the fix, an incomplete fix that left a path open, and the same class of bug…

原文语言：英语

history

Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.

原文语言：英语

zizmor

Audit GitHub Actions workflows with zizmor and explain reported hits using bundled trust-boundary references.

原文语言：英语

dependencies

Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.

原文语言：英语

audit-pii

Focused static audit for real personal or customer-identifying data committed to source or exposed through logs, URLs, telemetry, exports, and responses.

原文语言：英语

maintainers

Identify the real maintainers of a repository and the best way to contact them about a security issue. Distinguishes active leads from occasional contributors and bots, using commit history, issue activity, and registry ownership. Use when preparing a…

原文语言：英语

repo-overview

Run `brief --json` to produce a structured overview of the repository. Used by other skills as orientation.

原文语言：英语

advisories

Fetch published GHSA and CVE advisories affecting any package this repository produces, via advisories.ecosyste.ms.

原文语言：英语

metadata

Fetch repository metadata (description, default branch, languages, license, stars, archived, icon) from repos.ecosyste.ms and save it on the repository row.

原文语言：英语

audit-authz

Focused static audit for IDOR, tenant-isolation failures, missing or fail-open authorization guards, privilege escalation, and unverified claims used for access decisions.

原文语言：英语

audit-exfil

Focused static audit for attacker-controlled reads, requests, parsers, or error paths that can disclose files, metadata, secrets, or internal responses.

原文语言：英语

audit-injection

Focused static audit for attacker-controlled data reaching command execution, dynamic evaluation, unsafe deserialization, or server-side template execution.

原文语言：英语

revalidate

Cheap finding classifier. Reads a finding's six-step trace plus git history at its location and decides true_positive, false_positive, already_fixed, or uncertain, with an optional adjusted severity. Read-only; never executes the reproduction. Run…

原文语言：英语

variants

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

原文语言：英语

forensics

Build a read-only compromise timeline and evidence bundle from local Git history and public forge/archive records. Use after suspected maintainer, account, release, or source-history compromise; it produces evidence, not findings or remediation.

原文语言：英语

finding-dedup

Compare open findings in one repository and record how they relate. Marks same-vulnerability findings as duplicates, findings that another finding's fix will close as subsumed, and findings that combine into a higher-severity attack as a chain.

原文语言：英语

semgrep

Run semgrep's `p/security-audit` and `p/secrets` rulesets and map hits into the findings shape.

原文语言：英语

reachability

Check whether known sinks in this application's dependencies are reachable from its own trust boundaries. Scrutineer already holds findings against the libraries this app uses; this skill traces each one from the app's entry points to the library call and…

原文语言：英语

breaking-change

Decide whether a finding's suggested fix is a breaking change for top dependents. Reads the unified-diff fix on the finding, identifies the public API surface that changes (signatures, exports, removed fields, renamed types), and lists which top dependents…

原文语言：英语

cna-match

Match the repository to a CVE Numbering Authority so disclosures route to the CNA's security contact when one covers the repo.

原文语言：英语

exposure

For one (finding, dependent) pair, decide whether the dependent's code reaches the upstream finding. Emits a CSAF 2.0 product_status verdict with VEX justification.

原文语言：英语

ingest

Normalize an externally-produced security report in an arbitrary format into scrutineer findings. The raw report is staged at import/report by the /v1/import fallback; read it, extract each distinct finding, resolve locations against the checkout, and write…

原文语言：英语

mitigate

Draft operational mitigations for a finding consumers can apply before a fix ships. Workarounds (config flags, input restrictions, safe defaults), detection guidance (what to log and what pattern to alert on), and optionally a semgrep rule that flags the same…

原文语言：英语

posture

Assess a repository's security posture and its readiness to receive a vulnerability report. Checks for a security policy, private vulnerability reporting, security.txt, prior advisories, scanning workflows, and other hygiene signals, then rates the project…

原文语言：英语