torusguard 1.3.2 → 1.3.4

package/skills/torusguard/payload/skills/torusguard-status/SKILL.md

@@ -1,42 +1,58 @@
----
-name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
-version: 0.9.2
-workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
----
-
-# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
-
-## Objective
-Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
-
----
-
-## Execution Steps
-
-1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-5. **Render Diagnostic Overview:** Output formatted status card.
-
----
-
-## Safety Constraints
-- Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
-
----
-
-## Output Format
-```markdown
-🛡️ [TorusGuard] Workspace Status Overview
-- Version: v0.9.2 | Stack: <Detected Framework>
-- Active Rules: <Count> rules active in `.torusguard/rules/active/`
-- Historical Runs: <Count> runs recorded
-- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
-- Posture: <SECURE / ACTION REQUIRED>
-```
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob, run_command
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
+
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
+
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 71 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
+
+---
+
+## Output Card Format
+```markdown
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 71 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
+```

package/skills/torusguard/payload/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -18,14 +18,15 @@ Audit the evidence sufficiency of candidate findings by reading current disk lin
 ## Execution Steps
 
 1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
-2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
-3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
-4. **Calibrate Confidence Score:**
+2. **Handle CLI Failures:** If `python .torusguard/scripts/finding_scorer.py` or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.
+3. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+4. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+5. **Calibrate Confidence Score:**
    ```bash
    python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
    ```
-5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
-6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+6. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+7. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
 
 ---
 
@@ -47,7 +48,7 @@ A finding is verified as sufficient when:
 
 ## Output Format
 ```markdown
-🧪 [TorusGuard] Finding Verification Complete
+🧪 [TorusGuard] Finding Verification Complete (AI Assisted)
 - Findings Audited: <Count> | Confirmed Real: <Count>
 - False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
 - Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`

package/skills/torusguard/payload/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write
 scripts-binding:
@@ -34,11 +34,12 @@ All requests pass through `.torusguard/scripts/safety_gate.py`:
 ## Execution Steps
 
 1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
-2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
-3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
-4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
-5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
-6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.
+3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
 
 ---
 
@@ -56,7 +57,7 @@ All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk s
 
 ## Output Format
 ```markdown
-🌐 [TorusGuard] Web Validation Completed
+🌐 [TorusGuard] Web Validation Completed (AI Assisted)
 - Target: <Host URL> | Endpoints Tested: <Count>
 - Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
 - Replay Trace: `.torusguard/runs/<run_id>/requests.json`

package/skills/torusguard-apply/SKILL.md

@@ -1,46 +1,80 @@
----
-name: torusguard-apply
-description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation.
-version: 0.9.2
-workflow: .torusguard/workflows/apply.md
-tools: Read, Grep, Glob, Bash, Edit, Write
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
-  - .torusguard/scripts/diff_guard.py
----
-
-# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
-
-## Objective
-Safely apply approved remediation bundles to disk source files, capturing a byte-for-byte pre-apply backup snapshot and asserting syntax validity post-patch.
-
----
-
-## Execution Steps
-
-1. **Load Bundle:** Read `patch.diff` and metadata from `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
-2. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
-3. **Obtain Human Gate:** Confirm user approval for proposed diff.
-4. **Apply Patch:** Execute surgical modification using `replace_file_content` or `patch`.
-5. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors.
-6. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
-
----
-
-## Governance & Safety Rules
-- Hard limit: additions $\le 35$, deletions $\le 25$ lines.
-- Always create a rollback snapshot before modifying disk code.
-- If compile or syntax error occurs, instantly restore from `.bak`.
-- Require explicit operator confirmation before writing changes.
-
----
-
-## Output Format
-```markdown
-🚀 [TorusGuard] Patch Applied Successfully
-- Finding Target: <Finding ID> | File: <Path>
-- Churn: +<Additions> / -<Deletions>
-- Rollback Backup: `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
-- Compile Check: PASSED
-Next: Run `/torusguard recheck` to verify vulnerability is closed.
-```
+---
+name: torusguard-apply
+description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/apply.md
+tools: Read, Grep, Glob, Write, replace_file_content, run_command
+scripts-binding:
+  - .torusguard/scripts/apply_runner.py
+  - .torusguard/scripts/term_ui.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
+
+## Objective
+Safely apply approved remediation bundles to disk source files, creating an automated byte-for-byte pre-apply backup snapshot (`.bak`) in `.torusguard/snapshots/<run_id>/`, asserting syntax validity, and distilling passing patterns into Golden Fix Recipes.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution (Interactive or Non-Interactive)
+Run the governed patch applier from your terminal:
+```bash
+# Interactive Human Gate review (prompts for each patch: [y]es / [n]o / [a]ll / [q]uit)
+npx torusguard apply
+
+# Non-interactive automated application
+npx torusguard apply --yes
+
+# Apply patches from a specific run ID
+npx torusguard apply --run run-20260910-121618-audit --yes
+
+# Emergency rollback from pre-apply snapshot
+npx torusguard rollback
+# or
+npx torusguard apply --rollback
+```
+**Under the Hood:** Executes `python .torusguard/scripts/apply_runner.py`.
+1. Reads candidate bundles from `.torusguard/runs/<run_id>/bundles/`.
+2. Creates `.bak` snapshot in `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. Performs line-aware replacement without corrupting concurrent modifications.
+4. Distills the applied fix into a **Golden Fix Recipe** registered in `.torusguard/memory/patterns.json`.
+5. Emits `diff_summary.md` and `apply_plan.md` in the run directory.
+6. Displays pixel-perfect 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Application
+When applying patches directly within an AI chat session:
+1. **Human Gate Confirmation:** Present the unified diff to the operator and request explicit approval before editing code.
+2. **Pre-Apply Snapshot:** Ensure target file backup is created at `.torusguard/snapshots/<run_id>/<rel_path>.bak`.
+3. **Execute Surgical Edit:** Use `replace_file_content` to apply only the approved lines. Strictly adhere to the formulated Ponytail diff.
+4. **Syntax & Integrity Check:** Verify that the patched file is syntactically valid (e.g. `node --check <file>` or `python -m py_compile <file>`). If syntax fails, immediately restore from `.bak`.
+5. **Memory Registration:** Update persistent memory events in `.torusguard/memory/events.json` with event `fix_applied`.
+6. **Recommend Recheck:** Advise running `/torusguard recheck` or `npx torusguard recheck` to verify closure.
+
+---
+
+## Rollback Guarantee
+If an applied patch introduces unexpected runtime behavior or breaks tests:
+```bash
+# Instant one-command rollback of the latest applied run:
+npx torusguard rollback
+
+# Or rollback a specific run:
+npx torusguard rollback --run run-20260910-121618-audit
+```
+All affected files are restored byte-for-byte from `.torusguard/snapshots/<run_id>/`.
+
+---
+
+## Output Card Format
+```markdown
+### 🚀 TorusGuard Patch Applied Successfully
+- **Target File:** `server/index.js:9`
+- **Rule ID:** `TG-SEC-001` (Hardcoded JWT secret)
+- **Ponytail Churn:** +1 / -1
+- **Rollback Snapshot:** `.torusguard/snapshots/<run_id>/server/index.js.bak`
+- **Golden Recipe:** Distilled into persistent memory
+- **Next Step:** Run `npx torusguard recheck` or `/torusguard recheck` to verify closure
+```

package/skills/torusguard-audit/SKILL.md

@@ -1,70 +1,83 @@
----
-name: torusguard-audit
-description: Static AST scanning, memory pattern boosting, and 0–100 confidence scoring.
-version: 1.0.0
-workflow: .torusguard/workflows/audit.md
-tools: Read, Grep, Glob, Write
-scripts-binding:
-  - .torusguard/scripts/finding_scorer.py
-  - .torusguard/scripts/run_manager.py
----
-
-# TorusGuard Audit — Static Code Analysis & Memory Scanning
-
-## Objective
-Execute static AST analysis, query memory context, compute 0–100 confidence scores with memory boosts, and record findings to runs and memory.
-
----
-
-## Execution Steps
-
-1. **Run Setup:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
-2. **Context & Rules:** Load `.torusguard/memory/context.json` for patterns and false positives. Load rules from `.torusguard/rules/active/`.
-3. **AST Scan Sinks:** Match files against active rules:
-   - `TG-SEC-*`: Secrets and API keys.
-   - `TG-INPUT-*`: SQL injection, unvalidated input.
-   - `TG-DB-*`: Unscoped tenant queries (`Model.get(id=id)`).
-   - `TG-AUTH-*`: Insecure cookies, open CORS.
-   - `TG-CLIENT-*`: Client bundle secret leaks.
-4. **Stable Fingerprinting:** Compute SHA-256 hash of surrounding AST context.
-5. **Root-Cause Clustering:** Group findings by causal sink (`cluster-tenant-isolation`).
-6. **Scoring:** Calculate 0–100 score via `finding_scorer.py` (applies memory boost/suppression).
-7. **Write Artifacts:** Save `findings.json` and sync findings to memory engine.
-
----
-
-## Confidence Scoring Rubric
-- **1. Evidence (35):** AST flow (35), regex sink (20), heuristic (10).
-- **2. Reproduction (25):** Automated test (25), simulated (15), hypothesis (0).
-- **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
-- **4. Environment (15):** Explicit route (15), ambiguous (8), unknown (0).
-- **5. Review Status (10):** Human confirmed (10), agent verified (5), auto (0).
-- **Memory Modifier:** False positive (-30), regression (+15), recurring (+10).
-- **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
-
----
-
-## Finding Card Format
-```markdown
-### [TG-DB-004] Missing Tenant Scoping in /invoices/
-- **Severity**: High | **Confidence**: 90/100 (Confirmed) | **Memory Boost**: +10
-- **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
-- **Remediation**: Apply `.filter(tenant=request.user.tenant)`.
-```
-
----
-
-## Safety Constraints
-- Read-only analysis; zero code modifications during audit.
-- Exclude build directories (`node_modules/`, `.venv/`, `dist/`).
-- Redact secrets before saving to `findings.md`.
-
----
-
-## Output Format
-```markdown
-🛡️ [TorusGuard] Static Code Audit Completed
-- Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
-- Clusters: <Count> identified | Memory Patterns Applied: <Count>
-Next: Run `/torusguard harden` to formulate surgical fixes.
-```
+---
+name: torusguard-audit
+description: Static AST security scanning, line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/audit.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/term_ui.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Audit — Static Code Security Analysis
+
+## Objective
+Execute static AST analysis across polyglot project files, evaluate code against 71 canonical security rules across 11 families, assign stable line-shift invariant fingerprints, cluster architectural root causes, and score findings with auditable 0–100 confidence ratings.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the static security audit from your terminal:
+```bash
+# Scan current repository
+npx torusguard audit
+
+# Scan specific directory or example app
+npx torusguard audit ./examples/vulnerable-react-express
+
+# Include test fixtures and spec directories
+npx torusguard audit --include-tests
+
+# Output machine-readable JSON
+npx torusguard audit --json
+```
+**Under the Hood:** Executes `python .torusguard/scripts/audit_runner.py`.
+- Auto-detects repository stack and skips build/cache directories (`node_modules`, `.git`, `.venv`, `dist`, `build`).
+- Evaluates files across 11 canonical security families:
+  - `TG-SEC-*`: Hardcoded credentials, private keys, JWT secrets, client env leaks.
+  - `TG-INPUT-*`: SQL injection, command injection, path traversal, unsafe HTML rendering.
+  - `TG-DB-*`: Missing tenant isolation, service role keys in client code.
+  - `TG-AUTH-*`: Plaintext passwords, missing cookie security flags (httpOnly, secure, sameSite).
+  - `TG-PLATFORM-*`: Permissive wildcard CORS with credentials, missing security headers.
+  - `TG-DIFF-*`: Disabled TLS verification (`verify=False`, `rejectUnauthorized: false`).
+- Generates run directory: `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/`.
+- Writes `findings.json`, `findings.md`, and `manifest.json`.
+- Displays standardized 75-column terminal cards.
+- Returns exit code `1` if findings are discovered, `0` if clean.
+
+### Mode B: In-Session AI Chat Agent Scan
+When auditing files directly in AI chat:
+1. **Discover Sinks:** Use `grep_search` and `view_file` to search for dangerous patterns across server and client code.
+2. **Cluster Root Causes:** Group findings by causal architecture (e.g. `cluster-tenant-isolation`, `cluster-credentials-exposure`, `cluster-injection`).
+3. **Audit Evidence Sufficiency:** Ensure that user-controlled input reaches the vulnerable sink without prior sanitization or schema validation.
+4. **Present Actionable Findings:** Display finding cards with severity, rule ID, file, line, and remediation recommendation.
+5. **Prompt Next Phase:** Guide the operator to `/torusguard harden` or `npx torusguard harden`.
+
+---
+
+## Canonical Rule Families
+| Family | Scope | Example Violations |
+| :--- | :--- | :--- |
+| **TG-SEC** | Secrets & Credentials | Hardcoded JWT secret, API key strings, token logging |
+| **TG-INPUT** | Injection & Input Validation | Raw SQL interpolation, DOM `innerHTML`, `path.join` traversal |
+| **TG-DB** | Database & Tenant Scoping | Unscoped `.objects.get(id=...)`, Prisma missing `tenantId` |
+| **TG-AUTH** | Authentication & Cookies | Insecure cookies (missing httpOnly/secure/sameSite) |
+| **TG-PLATFORM** | Server & Platform Config | Wildcard CORS (`origin: '*'`) with credentials |
+| **TG-DIFF** | Security Bypasses | Disabled TLS verification (`verify=False`) |
+
+---
+
+## Output Card Format
+```markdown
+### 🛡️ TorusGuard Static Security Audit Completed
+- **Run ID:** `run-20260910-121618-audit`
+- **Scope:** 7 files evaluated across 11 canonical families
+- **Status:** ✖ CRITICAL FINDINGS DETECTED
+- **Findings:** 2 Critical, 2 High, 2 Medium/Low (6 total)
+- **Clusters:** 3 architectural root causes identified
+- **Artifacts:** `.torusguard/runs/<run_id>/findings.json`
+- **Next Action:** Run `npx torusguard harden` or `/torusguard harden`
+```

package/skills/torusguard-authorize/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-authorize
 description: Register and validate runtime target authorization boundaries — scope boundaries, ownership proofs, TTL expiration, and Safety Gate enforcement.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/authorize.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -24,8 +24,9 @@ Define and validate legal runtime authorization boundaries, verify target owners
    ```bash
    python .torusguard/scripts/safety_gate.py check --url <target_url>
    ```
-5. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
-6. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
+5. **Handle CLI Failures:** If `safety_gate.py` fails or is unavailable, YOU must manually verify the safety invariants and generate the JSON structure below.
+6. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
+7. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
 
 ---
 
@@ -38,7 +39,7 @@ Define and validate legal runtime authorization boundaries, verify target owners
 
 ## Output Format
 ```markdown
-🔒 [TorusGuard] Target Scope Authorized
+🔒 [TorusGuard] Target Scope Authorized (AI Assisted)
 - Target Host: <Host URL> | Environment: <Local / Staging>
 - Allowed Paths: <Prefixes> | Rate Limit: <Max Req/sec>
 - Expiration TTL: <Timestamp>

package/skills/torusguard-exploit-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-exploit-check
 description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/exploit-check.md
 tools: Read, Grep, Glob, Bash, Write
 scripts-binding:
@@ -36,14 +36,15 @@ Before dispatching any exploitability probe:
 
 1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
 2. **Select Canary:** Choose matching non-destructive probe strategy.
-3. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
-4. **Classify Status:** Transition finding into one of 5 canonical outcomes:
+3. **Handle Automation Failure:** If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using `curl` or `fetch`) and inspect the response.
+4. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
+5. **Classify Status:** Transition finding into one of 5 canonical outcomes:
    - `Confirmed`: Canary reflected or secondary tenant data leaked.
    - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
    - `Needs Review`: Ambiguous status code or incomplete response.
    - `Blocked by Controls`: WAF or rate limiter stopped probe.
    - `Out of Scope`: Target endpoint is not authorized.
-5. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
+6. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
 
 ---
 
@@ -56,7 +57,7 @@ Before dispatching any exploitability probe:
 
 ## Output Format
 ```markdown
-🎯 [TorusGuard] Exploitability Confirmation
+🎯 [TorusGuard] Exploitability Confirmation (AI Assisted)
 - Finding ID: <Finding ID> | Target: <Route>
 - Status: <Confirmed / Not Reproducible / Blocked>
 - Evidence: <Response snippet or status code>

package/skills/torusguard-full/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-full
 description: Master 7-stage security pipeline orchestrator — coordinates discovery, authorization, static audit, runtime validation, governed remediation, recheck, and reporting.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Bash, Edit, Write
 scripts-binding: