菜单
Running the SAiST (Static AI-assisted Security Testing) pipeline against a codebase. Use when the user wants to run static analysis rules, detect code smells, find vulnerability patterns, or scan code with the built-in rule engine. Covers the full gaps → resolve → run flow using the `aud` CLI.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Provides the `aud` CLI binary used by all other auditor-addon skills (estimator, security-auditor, threat-modeling, sast-pipeline, rule-authoring). Load this skill whenever any `aud` command needs to be invoked. The binary is at `<SKILL_DIR>/bin/aud` — use the `bin/aud` dispatcher which auto-selects the correct platform binary.
Conducting project scoping and estimation using logical chunking and metric analysis. Use when the user wants to estimate audit effort, scope a codebase for review, calculate hours for a security engagement, or assess the size of a diff or full repository.
Writing SAiST static analysis rules in Lua — both shipped rules in the auditor-addon repo and custom per-engagement rules in audit workspaces. Use when the user wants to create a new detection rule, add a security check, implement a code smell detector, turn a confirmed finding into a reusable rule, or extend the rule set. Covers rule types (scope/deep/map), the Lua API, language scoping, finding kinds, custom rules, and testing patterns.
Analyzing codebases to systematically identify and categorize potential security threats, producing a threat model report before code-level auditing. Use when starting an engagement and wanting to map the attack surface, identify high-value assets, and enumerate threat agents before diving into code-level analysis.
Conducting interactive security audits of codebases. RECON builds a structural map with the aud CLI and establishes trust assumptions. SCAN spawns fresh isolated agents to reason about clusters and hypotheses — the auditor steers every round. SWEEP checks risk pattern coverage with fresh agents. Use when the user wants to audit code, find vulnerabilities, review security, scan for bugs, or analyze code for exploits. Triggers on "audit", "security review", "find vulnerabilities", "scan contracts", "check for bugs".
Evaluate high-level protocol or system designs for overcomplication, then propose simpler, more structured alternatives with explicit trade-offs. Use when the user wants to challenge a system design, simplify an architecture, reduce protocol complexity, or compare design alternatives.
| name | sast-pipeline |
| description | Running the SAiST (Static AI-assisted Security Testing) pipeline against a codebase. Use when the user wants to run static analysis rules, detect code smells, find vulnerability patterns, or scan code with the built-in rule engine. Covers the full gaps → resolve → run flow using the `aud` CLI. |
| argument-hint | <files or scope> |
| allowed-tools | ["Read","Glob","Grep","Bash"] |
Three-phase static analysis: gaps → resolve → run rules.
This skill requires the auditor-addon-cli skill for the aud binary. Before running any aud command, load that skill to determine the correct binary path.
When the user provides specific files or a file list as input to this skill, use those exact files as the scope for all commands. Do NOT broaden to glob patterns — the user's scope is intentional, and broad globs pull in out-of-scope files that create irrelevant gaps and noisy findings.
# User provides: contracts/src/Vault.sol contracts/src/Token.sol
aud gaps contracts/src/Vault.sol contracts/src/Token.sol
# NOT: aud gaps "contracts/src/**/*.sol"
Only use glob patterns when the user explicitly asks for a broad scan (e.g., "scan all Solidity files").
Run aud gaps <files...> to build the symbol graph and emit all unresolved references. Use aud gaps --help for filtering options (by priority, kind, etc.).
Gaps only cover four reference kinds: import, call, inheritance, and using_for. State-variable, modifier, event, and custom-error references live in the AST, not the graph — rules query them via ast.find or graph.find_in_scope, so missing ones don't appear in aud gaps.
Gaps are grouped by priority:
high — in call chains from public entry pointsmedium — have public callerslow — internal, unlikely to affect rule accuracyClean (no gaps) → skip to Phase 3. Otherwise proceed to Phase 2.
Review gaps and resolve what you can. Create a CSV file:
ref_id,target_file,target_line,target_name
a4f2e81b,src/Ownable.sol,15,onlyOwner
b7c3d012,src/Ownable.sol,3,Ownable
Triage:
How to resolve a gap: Use only basic file operations — Read, Glob, Grep. No scripts.
Use aud peek on candidate files to quickly scan signatures without reading full source.
Iterate: After resolving a batch, re-run aud gaps <files...> --resolutions=resolutions.csv to confirm progress. Resolve more if high/medium gaps remain. Repeat until only low-priority or genuinely unresolvable gaps are left.
Resolution target files do NOT need to be in the original scope — aud automatically parses them into the graph when applying the CSV. Findings and gaps still only report on scoped files.
Run aud run <files...> --resolutions=resolutions.csv (omit --resolutions if Phase 1 was clean). Use aud run --help for options (specific rules, adhoc rule files, confidence filters, etc.).
Findings are tagged with a confidence kind:
issue — high confidence, confirmed defectsmell — medium confidence, likely problempointer — low confidence, suspicious patternCustom rules are .lua files (see rule-authoring skill for authoring details). The flywheel:
aud run --help for --rule-path usage)