Security audit
Security checks for vulnerabilities and agentic risk
This skill requires fresh evidence before claiming work is complete and explicitly limits verification to authorized scope and disposable test environments.
Expect additional verification commands and temporary worktrees. Follow the required disposable-environment checks before running tests or migrations; installation does not authorize publishing changes or bypassing hooks.
The supplied commands operate on the skill as an evaluation target. Although this tooling could support development of the declared behavior, the shown code does not implement that behavior; its visible purpose is evaluation and diagnostics. The underlying Python implementation was not supplied, so additional behavior cannot be established.
The supplied commands check the plugin itself. They show no mechanism for requiring fresh task-verification evidence, gating completion claims or handoffs, or handling ambiguous scope before edits. Although these checks could support development of the declared skill, the supplied code does not implement its stated runtime behavior. The internal behavior of distiller.py is not provided.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Run** the proof now. Earlier output, a subagent's report, confidence, and a renamed success phrase do not replace fresh execution.
5. **Read** complete output and exit status, including warnings, executed/passed counts, and missing artifacts. A suite that executes nothing is not proof. Confirm the intended binary, interpreter, source revision, and entry point actually ran.
- **Preserve raw evidence.** Display filters can produce plausible summaries while dropping records or rewriting bytes. Use unfiltered output when parsing, patches, counts, comparisons, or reviews depend on complete records or exact bytes. A downstream `head`, `tail`, or `cat` cannot restore filtered producer output.
6. **Verify** that evidence covers the requirements and relevant failure paths. An implemented safe positive capability must work through its intended entry point; a refusal-only path, stub, mock, or unreachable implementation is partial.
7. **Claim** only what the evidence establishes. Report the o
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
ys at its old value, so a test waiting for the new value passes vacuously. For each file the producing step writes, name the step that commits or ships it, and keep a subset contract test (producer set minus shipped set is empty) rather than a one-time read, because both lists drift independently.
**"Successfully rebased" is not proof the commit survived intact.** A three-way merge can resolve a pure insertion toward the new base when the surrounding lines were rewritten upstream: no conflict, no warning, the hunk simply gone from the commit. After any rebase, cherry-pick, or history rewrite, diff the commit's touched-file list across the operation (`git show --stat --name-only HEAD@{1}` against `HEAD`) and confirm the expected content is still present. Do this whenever the base moved since the branch was cut, not only when conflicts appeared: a clean run is not the evidence. A second mechanism drops a hunk just as quietly: `.gitattributes` can bind a path to a merge driver that keeps
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- **Boundary value**: 0, -1, empty string, empty array, `null`, `undefined`, `MAX_INT`, 1-char unicode combining mark
- **Concurrency**: two parallel requests with the same identifier (for state changes, races, double-spend classes)
- **Idempotency**: run the same mutation twice; the second should either no-op or error cleanly, not corrupt state
- **Orphan op**: delete/update/get a nonexistent ID. Does it 404/return-null as expected, or throw an internal error?
- **Implementation shape**: vary what callers supply to an I/O path or an extension point: a plugin with and without each optional method, a destination that exists and one that does not, a symlink, a read-only parent. A green suite, a clean sanitizer, and a differential API sweep share one blind spot: the signature is unchanged while the capability is gone, because an identical `false` for a different reason reads as no change. State the capability verified, not the aggregate.
- **Producer error path**: an invariant measured r
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Pre-Commit Hook Failures
A failing pre-commit hook is a verification checkpoint, not an obstacle to route around. **`git commit --no-verify` is forbidden when the current session's changes caused the failure; fix the root cause.** Permitted only when: (1) the failure reproduces on the base branch (show it), and (2) the user saw the failure first. A `--no-verify` the user never saw is a defeated check, the same failure mode as claiming completion without evidence.
## Rationalization Prevention
The migration guidance requires running an up/down/up cycle without explicitly restricting execution to an isolated, disposable database. Although 'production-shape data' does not mean a live production database, an agent following this operational checklist could run a destructive rollback against valuable data if its configured connection targets a shared or production environment.