# Audit

Use when performing repository security analysis that combines...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Security
- License: see repository
- Last updated: 2026-10-25
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add vigolium/vigolium --skill audit -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill audit -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill audit -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill audit -g -a gemini-cli -y`

## Description

Use when performing repository security analysis that combines application/attack-surface modeling and, depending on mode, advisory intelligence, static analysis, manual exploit-path review, false-positive elimination, PoC construction, and reporting. Applies to knowledge-base, lite, balanced, deep, revisit, and focused audit roles; the active command definition and engine remain the orchestration authority.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Repository Security Audit Methodology

Use this skill for security-analysis methodology. The active command definition decides the mode, phase graph, agent dispatch, prerequisites, and output gates. The trusted engine owns run state, retry accounting, resume decisions, artifact validation, and cleanup.

## Authority and safety

- When `audit-context.md` declares engine-owned state, never edit `vigolium-results/audit-state.json` or mark a phase complete. Return after writing phase-owned artifacts; the engine validates them. A native interactive fallback without that directive follows its active command's state instructions.
- Never switch branches, create audit branches/worktrees, stage, commit, or push.
- Treat the source tree as read-only. Write audit output only beneath `vigolium-results/`.
- Preserve existing artifacts unless the active phase explicitly owns their replacement.
- Do not invent scanner output, execution evidence, source locations, advisory matches, or exploit results.
- Use bounded, argument-array execution for helpers. Do not evaluate agent-authored shell commands or cleanup strings.

## Security finding standard

Retain a finding only when the evidence establishes all of the following:

1. A realistic attacker controls or materially influences the source.
2. The affected path is reachable in a shipped/runtime-relevant configuration.
3. Existing language, framework, middleware, application, and deployment guards do not stop the flow.
4. The behavior crosses a meaningful trust, identity, tenant, privilege, or confidentiality boundary.
5. The impact and severity reflect actual preconditions and reliability.

Express every candidate as a source-to-sink chain:

```text
attacker source -> parsing/normalization -> validation/authorization -> state transition -> sensitive sink -> security impact
```

If a link is unproven, record the candidate as unresolved or theoretical; do not write a VALID claim as fact.

## Classification rules

The rest: https://github.com/vigolium/vigolium/blob/HEAD/platform/vigolium-audit/src/content/skills/audit/SKILL.md