audit-context-building — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-context-building (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill governs how Claude thinks during the context-building phase of an audit.
When active, Claude will:
This skill defines a structured analysis format (see Example: Function Micro-Analysis below) and runs before the vulnerability-hunting phase.
Use when:
Do not use for:
When active, Claude will:
Goal: deep, accurate understanding, not conclusions.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "I get the gist" | Gist-level understanding misses edge cases | Line-by-line analysis required |
| "This function is simple" | Simple functions compose into complex bugs | Apply 5 Whys anyway |
| "I'll remember this invariant" | You won't. Context degrades. | Write it down explicitly |
| "External call is probably fine" | External = adversarial until proven otherwise | Jump into code or model as hostile |
| "I can skip this helper" | Helpers contain assumptions that propagate | Trace the full call chain |
| "This is taking too long" | Rushed context = hallucinated vulnerabilities later | Slow is fast |
Before deep analysis, Claude performs a minimal mapping:
This establishes anchors for detailed analysis.
Every non-trivial function receives full micro analysis.
For each function:
For each logical block:
Apply per-block:
(Full Integration of Jump-Into-External-Code Rule)
When encountering calls, continue the same micro-first analysis across boundaries.
#### Internal Calls
caller → callee → return → caller.
#### External Calls — Two Cases
Case A — External Call to a Contract Whose Code Exists in the Codebase Treat as an internal call:
Case B — External Call Without Available Code (True External / Black Box) Analyze as adversarial:
#### Continuity Rule Treat the entire call chain as one continuous execution flow. Never reset context. All invariants, assumptions, and
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.