adversarial-audit

Audit input entry points by mapping hypotheses onto a grid and falsifying them before fixes.

2|1|Updated May 11, 2019
One-click install
npx skills add https://github.com/guitarrapc/dotfiles-win --skill adversarial-audit-guitarrapc
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: adversarial-audit
Source: https://github.com/guitarrapc/dotfiles-win/tree/main/HOME/.agents/skills/adversarial-audit
Command: npx skills add https://github.com/guitarrapc/dotfiles-win --skill adversarial-audit-guitarrapc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Broad security and robustness reviews tend to either miss real issues outside a narrow scope or flood you with unverified findings. This Skill provides a structured audit process that achieves both coverage and accuracy by separating hypothesis generation from independent falsification. ## Core Features & Use Cases - Entry-point grid mapping: Builds a matrix of input entry points (URLs, config files, API/CLI arguments, environment variables, persistent storage) crossed with failure classes, so no cell is left unexamined. - Independent falsification phase: Sends hypotheses to a separate refutation lane that tries to kill each claim via upstream rejection, downstream absorption, false premises, or existing tests, keeping only verified findings. - Test promotion: Promotes surviving invariants into unit tests that measure properties across the whole catalog, preventing regressions of the same failure class elsewhere. - Use Case: When asked to comprehensively audit what an attacker or malformed input can do through every external entry point of an application, run this process to produce a verified findings list with reproduction steps and regression tests. ## Quick Start Audit this application's external input entry points for robustness using the adversarial audit process and report only falsification-surviving findings.

Frequently Asked Questions about adversarial-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit all input entry points of an application for robustness?

Build a grid of entry points crossed with failure classes, assign blank cells to parallel hypothesis lanes, then run an independent falsification phase on every claim. Only hypotheses that survive refutation proceed to live confirmation and fixes.

What is the difference between a security audit and a robustness audit?

A security audit assumes a threat model with a permission boundary to cross. When no such boundary exists, the same process becomes a state-integrity and robustness audit, and the skill explicitly tells you to rename the map and retarget what you chase.

Why does the audit require a separate falsification phase?

Measured results show the falsification phase rejects about two-thirds of hypotheses, mostly cases where a real code difference is not a real defect. Without it, you would fix things that are not broken and report unverified claims as findings.

When should I not use this adversarial audit process?

Skip it for investigating a single known bug, when there is only one entry point, or when the fix direction is already decided. It is designed for audits demanding both exhaustive coverage and high confidence across many entry points.

How are audit findings turned into regression tests?

Instead of encoding individual bug reproductions, the process promotes invariants that hold across the entire catalog, such as exhaustive validation of all enumerated values, completeness of deletion and initialization, and pins on where quantity limits derive from.