audit-context-building — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-context-building (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill governs how Claude thinks during the context-building phase of an audit.
When active, Claude will:
This skill defines a structured analysis format (see Example: Function Micro-Analysis below) and runs before the vulnerability-hunting phase.
Use when:
Do not use for:
This tree does not bundle FUNCTION_MICRO_ANALYSIS_EXAMPLE.md, OUTPUT_REQUIREMENTS.md, COMPLETENESS_CHECKLIST.md or a function-analyzer agent definition. Use the inline structure below and report missing upstream material; do not claim those files/agents were read or run. Numeric depth targets are prompts for inquiry, not permission to invent invariants or assumptions. Explicitly mark unknown behavior and uninspected external code; unresolved uncertainty is a valid result and must not be erased to satisfy a completion checklist.
When active, Claude will:
Goal: deep, accurate understanding, not conclusions.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "I get the gist" | Gist-level understanding misses edge cases | Line-by-line analysis required |
| "This function is simple" | Simple functions compose into complex bugs | Apply 5 Whys anyway |
| "I'll remember this invariant" | You won't. Context degrades. | Write it down explicitly |
| "External call is probably fine" | External = adversarial until proven otherwise | Jump into code or model as hostile |
| "I can skip this helper" | Helpers contain assumptions that propagate | Trace the full call chain |
| "This is taking too long" | Rushed context = hallucinated vulnerabilities later | Slow is fast |
Before deep analysis, Claude performs a minimal mapping:
This establishes anchors for detailed analysis.
Every non-trivial function receives full micro analysis.
For each function:
For each logical block:
Apply per-block:
(Full Integration of Jump-Into-External-Code Rule)
When encountering calls, continue the same micro-first analysis across boundaries.
#### Internal Calls
caller → callee → return → caller.
#### External Calls — Two Cases
Case A — External Call to a Contract Whose Code Exists in the Codebase Treat as an internal call:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.