What problem does it solve? Generic scanners and linters check whether code is internally consistent, but they cannot tell whether the code does what it was intended to do. The highest-value security and correctness bugs live in the gap between documented intent (permissions, trust boundaries, data classification) and actual implementation, and this Skill provides a method to find them. ## Core Features & Use Cases - Intent-to-Code Auditing: Treats documentation files like permissions.md, architecture.md, and variables.md as claims to verify against real enforcement points in code. - Evidence-Based Findings: Requires every finding to cite the documented intent, the implementing code (file and line), the attacker and victim, and a concrete fix. - Materiality Classification: Filters out cosmetic deviations and keeps only inconsistencies that cross trust, cost, data, or tenant boundaries. - Use Case: When auditing an AI-built codebase, use this Skill to verify that an endpoint documented as "cron-only" or "admin-only" actually enforces that restriction server-side on every code path. ## Quick Start Audit this repository against its documentation folder and report every place where the code contradicts the documented permissions or trust boundaries.
