@ryuenn3123/agentic-senior-core 5.8.21 → 5.8.22

package/hooks/post-edit-enforce.js

@@ -1,234 +0,0 @@
-#!/usr/bin/env node
-// Agentic Senior Core — PostToolUse enforcement hook
-// Fires after Edit/Write. Checks for ladder violations and injects a nudge.
-// Supports Claude Code, Codex CLI, and GitHub Copilot CLI.
-
-const fs = require('fs');
-const path = require('path');
-
-let STDLIB_DUPLICATES = new Set([
-  'lodash', 'lodash-es', 'underscore',
-  'moment', 'dayjs',
-  'uuid', 'nanoid',
-  'chalk', 'kleur', 'colorette',
-  'axios', 'got', 'node-fetch', 'superagent',
-  'mkdirp', 'rimraf', 'del',
-  'glob', 'globby',
-  'left-pad', 'pad-left',
-  'is-odd', 'is-even', 'is-number', 'is-string',
-  'path-exists', 'fs-extra',
-]);
-
-try {
-  const knownPath = path.join(__dirname, 'lib', 'known-duplicates.json');
-  if (fs.existsSync(knownPath)) {
-    const raw = JSON.parse(fs.readFileSync(knownPath, 'utf8'));
-    if (Array.isArray(raw.duplicates)) {
-      STDLIB_DUPLICATES = new Set(raw.duplicates);
-    }
-  }
-} catch (_) {}
-
-const SOURCE_EXTENSIONS = new Set([
-  'js', 'ts', 'mjs', 'cjs', 'jsx', 'tsx',
-  'py', 'rb', 'go', 'rs', 'java', 'kt', 'swift', 'cs',
-]);
-
-const LOC_DELTA_THRESHOLD = 30;
-const NEW_FILE_LINE_THRESHOLD = 50;
-
-let inputBuffer = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', function (chunk) { inputBuffer += chunk; });
-process.stdin.on('end', function () {
-  try {
-    const data = JSON.parse(inputBuffer);
-    const toolName = data.tool_name || '';
-    const toolInput = data.tool_input || {};
-    const filePath = toolInput.file_path || '';
-    const findings = [];
-
-    if (filePath.endsWith('package.json')) {
-      checkDependencyAddition(toolName, toolInput, findings);
-    }
-
-    const ext = path.extname(filePath).slice(1);
-    if (SOURCE_EXTENSIONS.has(ext)) {
-      if (toolName === 'Edit') {
-        checkLocDelta(toolInput, filePath, findings);
-      } else if (toolName === 'Write') {
-        checkNewFileSize(toolInput, filePath, findings);
-      }
-    }
-
-    checkLivingDocNudge(filePath, findings);
-
-    if (ext !== 'md') {
-      checkWorkflowGate(toolName, filePath, ext, findings);
-    }
-
-    if (findings.length === 0) return;
-
-    const nudge = '[ASC enforcement] ' + findings.join(' ') + ' Review the decision ladder before continuing.';
-    emit(nudge);
-  } catch (_) {
-    // Silent fail — enforcement must not break the session
-  }
-});
-
-function checkDependencyAddition(toolName, toolInput, findings) {
-  var target = toolName === 'Edit' ? (toolInput.new_string || '') : (toolInput.content || '');
-  var baseline = toolName === 'Edit' ? (toolInput.old_string || '') : '';
-
-  var depPattern = /"([^"]+)"\s*:\s*"[~^>=<*]?\d/g;
-  var newDeps = extractDeps(target, depPattern);
-  var oldDeps = extractDeps(baseline, depPattern);
-
-  var added = newDeps.filter(function (d) { return oldDeps.indexOf(d) === -1; });
-  if (added.length === 0) return;
-
-  var stdlibDupes = added.filter(function (d) { return STDLIB_DUPLICATES.has(d); });
-  if (stdlibDupes.length > 0) {
-    findings.push(
-      'Dependency ' + stdlibDupes.join(', ') + ' may duplicate stdlib/platform features. '
-      + 'Ladder step 3: does the standard library cover this?'
-    );
-  } else {
-    findings.push(
-      'New dependency added: ' + added.join(', ') + '. '
-      + 'Ladder step 3-4: stdlib or already-installed alternative?'
-    );
-  }
-}
-
-function extractDeps(text, pattern) {
-  var matches = [];
-  var match;
-  while ((match = pattern.exec(text)) !== null) {
-    matches.push(match[1]);
-  }
-  return matches;
-}
-
-function checkLocDelta(toolInput, filePath, findings) {
-  var newLines = (toolInput.new_string || '').split('\n').length;
-  var oldLines = (toolInput.old_string || '').split('\n').length;
-  var delta = newLines - oldLines;
-  if (delta > LOC_DELTA_THRESHOLD) {
-    findings.push(
-      'Edit added ' + delta + ' net lines to ' + path.basename(filePath) + '. '
-      + 'Ladder step 5: can this be one straightforward function?'
-    );
-  }
-}
-
-function checkNewFileSize(toolInput, filePath, findings) {
-  var lines = (toolInput.content || '').split('\n').length;
-  if (lines > NEW_FILE_LINE_THRESHOLD) {
-    findings.push(
-      'New file ' + path.basename(filePath) + ' created with ' + lines + ' lines. '
-      + 'Ladder step 1-2: does this need to be built? Does the codebase already have this?'
-    );
-  }
-}
-
-function checkLivingDocNudge(filePath, findings) {
-  var lower = filePath.toLowerCase();
-  if (lower.includes('schema') || lower.includes('migration') || lower.includes('model') || lower.includes('prisma')) {
-    findings.push(
-      '[ASC Living Doc] Data contract/model modified in ' + path.basename(filePath) + '. '
-      + 'Ensure docs/Schema.md and docs/Architecture.md are kept in sync to prevent spec drift.'
-    );
-  }
-}
-
-function checkWorkflowGate(toolName, filePath, ext, findings) {
-  try {
-    var pathUtil = require('./path-util.cjs');
-    var gatePath = pathUtil.getWorkflowGatePath(process.cwd());
-    if (!fs.existsSync(gatePath)) return;
-    
-    var gateStr = fs.readFileSync(gatePath, 'utf8');
-    var gate = JSON.parse(gateStr);
-    
-    if (gate.updatedAt) {
-      var ageHours = (Date.now() - new Date(gate.updatedAt).getTime()) / (1000 * 60 * 60);
-      if (ageHours > 4) {
-        fs.unlinkSync(gatePath);
-        findings.push('Cleared stale workflow gate (' + gate.workflow + ').');
-        return;
-      }
-    }
-    
-    if (gate.phase === 'research' || gate.phase === 'plan') {
-      findings.push(
-        'Workflow gate bypass: ' + gate.workflow + ' is in ' + gate.phase + ' phase but source code was edited. '
-        + 'Stop and wait for phase approval. If you must proceed, log this bypass to the debt ledger.'
-      );
-    } else if (gate.phase === 'implement') {
-      validateDocSpecs(gate.workflow, findings);
-    }
-  } catch (_) {
-    // Silent fail
-  }
-}
-
-function validateDocSpecs(workflow, findings) {
-  try {
-    var cwd = process.cwd();
-    var docsDir = path.join(cwd, 'docs');
-    
-    // Anti-typo check for common doc typos (e.g. Architectyre.md)
-    var searchDirs = [cwd, docsDir];
-    var typoFound = false;
-    searchDirs.forEach(function (d) {
-      if (fs.existsSync(d)) {
-        var files = fs.readdirSync(d);
-        files.forEach(function (f) {
-          if (f.toLowerCase() !== f && /architect[y|u]re/i.test(f) && f !== 'Architecture.md') {
-            findings.push('[ASC Spec Typo Alert] Typo detected in doc filename "' + f + '". Rename to "Architecture.md".');
-            typoFound = true;
-          }
-        });
-      }
-    });
-
-    if (workflow === 'asc-new-project') {
-      var requiredDocs = ['PRD.md', 'Architecture.md', 'Design.md', 'Schema.md'];
-      var missing = requiredDocs.filter(function (doc) {
-        return !fs.existsSync(path.join(cwd, doc)) && !fs.existsSync(path.join(docsDir, doc));
-      });
-      if (missing.length > 0) {
-        findings.push(
-          '[ASC 5-Doc SDD Gate] Greenfield project missing spec document(s): ' + missing.join(', ') + '. '
-          + 'Create them in docs/ to align requirements before continuing implementation.'
-        );
-      }
-    } else if (workflow === 'asc-add-feature') {
-      var hasPrd = fs.existsSync(path.join(cwd, 'PRD.md')) || fs.existsSync(path.join(docsDir, 'PRD.md'));
-      if (!hasPrd) {
-        findings.push(
-          '[ASC SDD Gate] Feature addition missing docs/PRD.md. Define goals and non-goals before coding.'
-        );
-      }
-    }
-  } catch (_) {}
-}
-
-function emit(nudge) {
-  try {
-    var isCopilot = Boolean(process.env.COPILOT_PLUGIN_DATA);
-    var output = {
-      hookSpecificOutput: {
-        hookEventName: 'PostToolUse',
-        additionalContext: nudge,
-      },
-    };
-    if (isCopilot) {
-      output = { additionalContext: nudge };
-    }
-    process.stdout.write(JSON.stringify(output));
-  } catch (_) {
-    // EPIPE — silent
-  }
-}

package/hooks/pre-tool-dependency-gate.js

@@ -1,155 +0,0 @@
-#!/usr/bin/env node
-// Agentic Senior Core — PreToolUse dependency gate hook
-// Hard-blocks edits/writes to package.json AND shell commands (npm install/yarn add/ascx)
-// if new dependencies duplicate stdlib/platform features.
-// Supports Claude Code, Antigravity IDE (run_command), and Copilot CLI hook response formats.
-
-const fs = require('fs');
-const path = require('path');
-
-let knownDuplicates = new Set();
-try {
-  const knownPath = path.join(__dirname, 'lib', 'known-duplicates.json');
-  if (fs.existsSync(knownPath)) {
-    const raw = JSON.parse(fs.readFileSync(knownPath, 'utf8'));
-    if (Array.isArray(raw.duplicates)) {
-      knownDuplicates = new Set(raw.duplicates);
-    }
-  }
-} catch (_) {
-  // Fallback set if JSON loading fails
-  knownDuplicates = new Set(['lodash', 'underscore', 'moment', 'dayjs', 'uuid', 'axios', 'rimraf']);
-}
-
-let inputBuffer = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', function (chunk) { inputBuffer += chunk; });
-process.stdin.on('end', function () {
-  try {
-    const data = JSON.parse(inputBuffer);
-    const toolName = data.tool_name || data.toolName || '';
-    const toolInput = data.tool_input || data.toolInput || {};
-    let added = [];
-
-    const isTerminal = ['Bash', 'run_command', 'run_shell_command', 'terminal', 'execute_command'].includes(toolName);
-    const isFileEdit = ['Edit', 'Write', 'replace_file_content', 'write_to_file', 'write_file', 'multi_replace_file_content'].includes(toolName);
-
-    if (isTerminal) {
-      const command = toolInput.command || toolInput.CommandLine || toolInput.cmd || toolInput.commandLine || '';
-      added = extractCommandDeps(command);
-    } else if (isFileEdit) {
-      const filePath = toolInput.file_path || toolInput.TargetFile || toolInput.path || toolInput.target_file || '';
-      if (!filePath.endsWith('package.json')) {
-        process.exit(0);
-        return;
-      }
-      const target = (toolName === 'Edit' || toolName === 'replace_file_content')
-        ? (toolInput.new_string || toolInput.ReplacementContent || toolInput.content || '')
-        : (toolInput.content || toolInput.CodeContent || '');
-      const baseline = (toolName === 'Edit' || toolName === 'replace_file_content')
-        ? (toolInput.old_string || toolInput.TargetContent || '')
-        : '';
-
-      const depPattern = /"([^"]+)"\s*:\s*"[~^>=<*]?\d/g;
-      const newDeps = extractDeps(target, depPattern);
-      const oldDeps = extractDeps(baseline, depPattern);
-
-      added = newDeps.filter(function (d) { return oldDeps.indexOf(d) === -1; });
-    }
-
-    if (added.length === 0) {
-      process.exit(0);
-      return;
-    }
-
-    const allowlist = loadAllowlist();
-    const forbidden = added.filter(function (dep) {
-      return knownDuplicates.has(dep) && !allowlist.has(dep);
-    });
-
-    if (forbidden.length > 0) {
-      const reason = '[ASC Hard-Block] Dependency ' + forbidden.map(function(d){ return "'" + d + "'"; }).join(', ') 
-        + ' duplicates standard library or native platform features. '
-        + 'Ladder step 3: use stdlib/native features instead, or add to .asc/dependency-allowlist.json to override.';
-      
-      const output = {
-        allow_tool: false,
-        deny_reason: reason,
-        hookSpecificOutput: {
-          hookEventName: 'PreToolUse',
-          permissionDecision: 'deny',
-          permissionDecisionReason: reason
-        }
-      };
-      process.stdout.write(JSON.stringify(output) + '\n');
-      process.exit(2);
-      return;
-    }
-  } catch (_) {
-    // Silent fail to ensure session stability
-  }
-  process.exit(0);
-});
-
-function extractDeps(text, pattern) {
-  const matches = [];
-  let match;
-  while ((match = pattern.exec(text)) !== null) {
-    matches.push(match[1]);
-  }
-  return matches;
-}
-
-function extractCommandDeps(command) {
-  const installRegex = /(?:npm|yarn|pnpm|bun|ascx)\s+(?:install|i|add)(?:\s+[^\s]+)*/i;
-  if (!installRegex.test(command)) return [];
-
-  const parts = command.split(/\s+/);
-  const pkgIndex = parts.findIndex(p => ['install', 'i', 'add'].includes(p.toLowerCase()));
-  if (pkgIndex === -1 || pkgIndex >= parts.length - 1) return [];
-
-  const rawArgs = parts.slice(pkgIndex + 1);
-  const deps = [];
-  for (let arg of rawArgs) {
-    if (arg.startsWith('-')) continue; // Skip flags like -D, --save-dev
-    if (arg.startsWith('http://') || arg.startsWith('https://') || arg.startsWith('git+')) continue;
-    
-    // Remove scope/version if any, e.g. lodash@^4.17 -> lodash, @types/node@18 -> @types/node
-    let name = arg;
-    if (name.startsWith('@')) {
-      const slashIndex = name.indexOf('/');
-      if (slashIndex !== -1) {
-        const atIndex = name.indexOf('@', slashIndex);
-        if (atIndex !== -1) name = name.substring(0, atIndex);
-      }
-    } else {
-      const atIndex = name.indexOf('@');
-      if (atIndex !== -1) name = name.substring(0, atIndex);
-    }
-    if (name) deps.push(name);
-  }
-  return deps;
-}
-
-function loadAllowlist() {
-  const allowed = new Set();
-  const candidates = [
-    path.join(process.cwd(), '.asc', 'dependency-allowlist.json'),
-    path.join(process.cwd(), '.agents', 'dependency-allowlist.json')
-  ];
-
-  for (let i = 0; i < candidates.length; i++) {
-    try {
-      if (fs.existsSync(candidates[i])) {
-        const content = JSON.parse(fs.readFileSync(candidates[i], 'utf8'));
-        const deps = content.allowedDependencies || content.allowed || {};
-        if (Array.isArray(deps)) {
-          deps.forEach(function (d) { allowed.add(d); });
-        } else if (typeof deps === 'object') {
-          Object.keys(deps).forEach(function (d) { allowed.add(d); });
-        }
-      }
-    } catch (_) {}
-  }
-  return allowed;
-}

package/hooks/session-start.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-// Agentic Senior Core — SessionStart hook
-// Injects universal coding rules on every session start.
-// Supports Claude Code, Codex CLI, and GitHub Copilot CLI.
-
-const fs = require('fs');
-const path = require('path');
-
-const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
-const isCopilot = Boolean(process.env.COPILOT_PLUGIN_DATA);
-const isCodex = !isCopilot && Boolean(process.env.PLUGIN_DATA);
-
-let content;
-try {
-  content = fs.readFileSync(path.join(pluginRoot, 'AGENTS.md'), 'utf8');
-} catch (e) {
-  process.exit(0);
-}
-
-try {
-  if (isCopilot) {
-    process.stdout.write(JSON.stringify({ additionalContext: content }));
-  } else if (isCodex) {
-    process.stdout.write(JSON.stringify({
-      systemMessage: 'ASC:ACTIVE',
-      hookSpecificOutput: {
-        hookEventName: 'SessionStart',
-        additionalContext: content,
-      },
-    }));
-  } else {
-    process.stdout.write(content);
-  }
-} catch (e) {
-  // Silent fail — stdout closed/EPIPE at hook exit must not surface as a hook failure
-}

package/hooks/subagent-start.js

@@ -1,38 +0,0 @@
-#!/usr/bin/env node
-// Agentic Senior Core — SubagentStart hook
-// SessionStart context is parent-thread only and never reaches subagents.
-// This injects the same ruleset into each subagent.
-
-const fs = require('fs');
-const path = require('path');
-
-const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
-const isCopilot = Boolean(process.env.COPILOT_PLUGIN_DATA);
-const isCodex = !isCopilot && Boolean(process.env.PLUGIN_DATA);
-
-let content;
-try {
-  content = fs.readFileSync(path.join(pluginRoot, 'AGENTS.md'), 'utf8');
-} catch (e) {
-  process.exit(0);
-}
-
-try {
-  if (isCodex) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: 'SubagentStart',
-        additionalContext: content,
-      },
-    }));
-  } else {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: 'SubagentStart',
-        additionalContext: content,
-      },
-    }));
-  }
-} catch (e) {
-  // Silent fail
-}

package/skills/asc/SKILL.md

@@ -1,36 +0,0 @@
----
-name: asc
-description: >
-  Universal AI coding rules. Write code like a staff engineer. Use this skill when user asks for general coding guidelines, best practices, standard rules, code quality standards, or when acting as a senior/staff software engineer.
----
-
-# Agentic Senior Core
-
-Universal AI coding rules. Write code like a staff engineer.
-
-## Available Commands
-
-- `/asc-new-project` -- Greenfield workflow (Define -> Spec -> Implement -> Validate)
-- `/asc-add-feature` -- Brownfield workflow (Research -> Plan -> Implement)
-- `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
-- `/asc-review` -- Production-risk code review with severity-ordered findings
-- `/asc-audit` -- Security and architecture audit
-- `/asc-reference` -- Domain-specific rules (testing, API, database, frontend, infra, resilience)
-- `/asc-debt` -- Track deferred enforcement violations (add, list, resolve, summary)
-- `/asc-help` -- Show this help
-
-## Enforcement
-
-On plugin-tier hosts (Claude Code, Codex CLI, Copilot CLI), a PostToolUse hook fires after every Edit/Write and checks:
-- New dependencies against stdlib duplicates (decision ladder step 3)
-- LOC delta > 30 lines on edits (step 5)
-- New files > 50 lines (steps 1–2)
-- Workflow gate violations: source/config edits during research or plan phases
-
-Violations inject a nudge referencing the specific ladder step or workflow phase. The hook is silent when no issues are found. All enforcement is advisory — nudges, not hard blocks.
-
-## What It Does
-
-Loads universal engineering rules on every session: code quality, architecture, security, error handling, testing, API design, database, frontend, infrastructure, resilience, and async patterns.
-
-Rules apply to any project, stack, language, or framework. No per-project configuration needed.

package/skills/asc-adapter/SKILL.md

@@ -1,43 +0,0 @@
----
-name: asc-adapter
-description: >
-  Detect installed AI coding hosts and generate adapter files for the current project. Use this skill when user asks to install, configure, setup, or initialize Agentic Senior Core rules, adapter files, or plugins for their IDE (Cursor, Windsurf, Devin, Copilot, Roo, Cline, Aider, Kiro).
----
-
-# ASC Adapter
-
-Detect installed AI coding hosts and generate adapter files for the current project.
-
-## When to use
-
-Run this when setting up a new project or when a developer wants ASC rules active across all their AI coding tools.
-
-## Steps
-
-1. Run `asc status` to detect which AI coding hosts are installed on this system.
-2. Check which adapter files already exist in the current project directory.
-3. For any detected host that is missing an adapter, run `asc adapter --<host>` to generate it.
-4. Use `asc adapter --all` to generate adapters for all supported hosts at once.
-
-## Supported hosts
-
-Plugin hosts (always-on, no adapter needed): Claude Code, Codex CLI, Gemini CLI, Antigravity CLI, Copilot CLI, Devin CLI, Hermes, OpenCode, OpenClaw.
-
-Adapter hosts (one file per project): Cursor, Devin Desktop, Cline, GitHub Copilot, Kiro, Continue, Zed, Aider, Kilo Code, Roo Code, OpenHands.
-
-## Commands
-
-```bash
-asc status                # Show detected hosts
-asc adapter --all         # Generate all adapters
-asc adapter --cursor      # Generate for specific host
-asc uninstall             # Remove all ASC adapter files
-asc uninstall --dry-run   # Preview what would be removed
-```
-
-## Notes
-
-- Adapter files contain the ASC universal coding rules, compressed to fit within each host's size limits.
-- Cursor uses `.mdc` format with `alwaysApply: true` frontmatter.
-- Windsurf is now Devin Desktop. Use `--devin` for the preferred path, `--windsurf` for legacy.
-- Zed also reads `AGENTS.md` natively, so the adapter is optional.

package/skills/asc-add-feature/SKILL.md

@@ -1,53 +0,0 @@
----
-name: asc-add-feature
-description: >
-  Structured brownfield workflow. Adapted from QRSPI to prevent context rot and ensure alignment before building. Use this skill when user asks to add new features, build new endpoints, extend existing functionality, implement new UI components, modify an existing codebase, or work on brownfield development.
----
-
-# Add Feature Workflow
-
-Structured brownfield workflow. Adapted from QRSPI to prevent context rot and ensure alignment before building.
-
-Grounded in: RPI (Dex Horthy, HumanLayer 2025) with corrections from QRSPI 8-stage evolution (Coding Agents Conference, March 2026). Plan-reading illusion fix and instruction budget constraint applied. Stages 2/5/7 adapted; stages 1/3/4/6/8 skipped as too heavyweight for individual-developer workflow.
-
-## Gate Mechanism & Scaled Spec Requirement
-
-This workflow nudges the agent to stop at each phase boundary, same enforcement tier as the existing decision ladder — not a hard block. Bypasses are logged to the debt ledger.
-
-For brownfield feature development (`asc-add-feature`), Phase 2 requires a lightweight **PRD.md** (or feature spec in `docs/PRD.md`) defining product intent, goals, and non-goals to avoid scope creep and context rot.
-
-To track phase, write to `workflow-gate.json` via the `state_write` MCP tool.
-Format:
-```json
-{
-  "workflow": "asc-add-feature",
-  "phase": "<current_phase>",
-  "updatedAt": "<ISO-timestamp>"
-}
-```
-
-## Phase 1: Research (No Code Changes)
-
-1. Write `workflow-gate.json` with phase `research`.
-2. Map existing code: patterns, utilities, dependencies already in use.
-3. Identify what must NOT be rebuilt (e.g., existing validation helpers).
-4. Output a factual research summary.
-5. **STOP and wait for user approval.** Do not plan or implement.
-
-## Phase 2: Plan
-
-1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
-2. Ensure `docs/PRD.md` or feature brief exists.
-3. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
-4. Include a "Don't Build" list from the research phase.
-5. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the plan against the codebase, not just skim it.
-6. Output the plan.
-7. **STOP and wait for user approval.** Do not implement.
-
-## Phase 3: Implement
-
-1. On approval of Phase 2, update `workflow-gate.json` phase to `implement`.
-2. Recommend a fresh context (intentional compaction) if the context window is getting full.
-3. Execute the approved plan.
-4. Validate: tests pass, no duplicate code introduced, plan items checked off.
-5. On completion, clear the state in `workflow-gate.json` by overwriting it with `{}`.

package/skills/asc-audit/SKILL.md

@@ -1,36 +0,0 @@
----
-name: asc-audit
-description: >
-  Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns. Use this skill for deep security audits, architecture reviews, vulnerability scanning, threat modeling, finding OWASP risks (XSS, SQLi), penetration testing, or identifying structural anti-patterns.
----
-
-# Audit Skill
-
-Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
-
-Grounded in: OWASP Top 10 (2021), OWASP ASVS v4, CVSS vulnerability report structure, CWE classification.
-
-## Audit Scope
-
-1. **Trust boundaries**: Every point where external input enters the system. Validate that inputs are sanitized, normalized, and rejected when invalid.
-2. **Authentication and authorization**: Verify auth checks exist on every endpoint. Check for resource-level authorization, not just identity.
-3. **Data handling**: Secrets in code or logs, PII exposure, unsafe deserialization, SQL injection, command injection.
-4. **Architecture boundaries**: Business logic in transport layer, shared databases between services, circular dependencies, internal model leakage through public APIs.
-5. **Dependency health**: Known vulnerabilities, unmaintained packages, excessive dependency surface.
-6. **Error exposure**: Stack traces, internal paths, or implementation details exposed to clients.
-
-## For Every Finding
-
-```
-Severity: critical | high | medium | low
-Class: vulnerability class (e.g., SQL Injection, Broken Access Control)
-Location: file:line
-Impact: who or what is affected
-Evidence: exact code, behavior, or command output
-Remediation: specific fix direction
-Validation: how to prove it is fixed
-```
-
-## Output
-
-Findings ordered by severity. If no findings, state that explicitly and describe audit coverage.