{"slug":"trailofbits-audit-context-building","name":"audit-context-building","description":"Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.","long_description":"---\nname: audit-context-building\ndescription: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.\nallowed-tools: Task Read Grep Glob\n---\n\n# Audit Context Building\n\nBuild understanding, not verdicts. This runs before anyone hunts for bugs, and feeds that work.\n\n## When to Use\n\nAt the start of an audit, a threat model, or an architecture review, when the code is unfamiliar. Also when\nan earlier pass produced findings nobody could judge, because no one had mapped out how the system fits\ntogether.\n\n## When NOT to Use\n\nDo not name vulnerabilities, suggest fixes, write proofs-of-concept, or rate severity. Those belong to the\nhunting phase, which runs next and with the whole picture in hand. When the code counts on something and\nnothing checks it, record that plainly and move on — whether it matters is decided later.\n\nNot worth the tokens on code you already understand.\n\n## Do not analyze in this context\n\nThe analysis is long, and this context needs to survive to use it. Dispatch it:\n\n- **A codebase, or more than one function** — run `/audit-context-building:audit-context <path>`. It orients,\n  analyzes each function in its own subagent, and writes `audit-context/DOSSIER.md` plus one file per\n  function under `audit-context/functions/`. Only compact records return here.\n- **A single function** — dispatch the `audit-context-building:function-analyzer` agent at it. It writes its\n  prose to disk and returns a record.\n\nThen work from what comes back: the index, the unenforced assumptions, the open questions. Read a function's\nfile when you need its detail.\n\nThe workflow is what enforces this, not this text: a subagent bound to a return schema cannot return prose.\nTreat this section as routing, and route.\n\n## What comes back, and how to read it\n\nEach record lists what must always be true (with the line that shows it), what the function takes on faith\n(with whatever establishes it), which functions it calls and what it needs from each, and anything still\nunclear. The dossier adds the rules that span several functions, who can reach what, and where the\ncomplicated parts cluster.\n\nTwo things matter more than the rest:\n\n- **Assumptions marked `nothing found`.** The code counts on something being true and nothing anywhere makes\n  it true. This is the most useful thing to hand the hunting phase.\n- **The open questions.** An honest list of what is still unclear beats a confident answer that turns out to\n  be wrong. Carry them forward instead of closing them out.\n\nWhere two records disagree, both are quoted rather than quietly reconciled. That is a fact about the code,\nnot a flaw in the analysis.\n\n## The format\n\n[ANALYSIS_FORMAT.md](resources/ANALYSIS_FORMAT.md) defines it, and\n[FUNCTION_MICRO_ANALYSIS_EXAMPLE.md](resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md) works through examples in\nC and Solidity. Read them when extending this plugin or deciding whether a record can be trusted.\n\nThe format is the same whatever the target. What changes is what fills each slot, and what counts as a call\nyou cannot see inside. [DOMAIN_NOTES.md](resources/DOMAIN_NOTES.md) maps that across smart contracts, C and\nC++, decompiled firmware, and web services — read it when the target is not plain source code.\n\n**The rule that matters most: follow the calls.** Whether a function is correct usually depends on something\nanother function does, and you cannot see that from the caller alone. A limit looks enforced because the\nvalue came back from a function whose name suggests it was checked. So read the function being called, follow\nevery path through it rather than only the one that succeeds, and say what makes each assumption true. When\nnothing does, use those words: `nothing found`. Every claim cites a line, or becomes an open question.\n","tagline":"Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.","category":"security","tags":["agent-skill"],"author":"trailofbits","verified":false,"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-audit-context-building#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6823,"forks":585,"verified_installs":0,"successful_runs":0,"total_outcomes":0,"rating":0,"review_count":0,"quality_score":50.39},"quality":{"score":86,"tier":"excellent","label":"Excellent","summary":"High-confidence pick with strong adoption and healthy maintenance signals.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"Today","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v5","score":83,"base_score":86,"outcome_confidence":0,"tier":"strong","label":"Review then install","summary":"Good shortlist signal, but the agent should review audit notes, install policy, and outcome evidence before running it.","recommendedAction":"Use as the primary candidate after human or sandbox review.","decision":{"install_policy":"agent_install_candidate","auto_install_allowed":false,"human_review_required":true,"sandbox_first":true,"agent_action":"Ask for approval or run a sandbox-only trial before installing.","reasoning":["83/100 Trust Score v5","86/100 Trust Score v4 baseline","Needs more real agent outcomes before unattended install","Install path is available","Low metadata risk"],"review_required_when":["The workspace contains production secrets, payments, private customer data, or irreversible actions.","The install command requests shell, network, credential, database, or broad filesystem access.","Outcome evidence is missing, recently failed, or required human review.","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"]},"dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"Pushed today"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":86,"weight":0.14,"status":"pass","detail":"Metadata includes enough usage and workflow context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":74,"weight":0.07,"status":"info","detail":"filesystem or document access, database access"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"Pushed today"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"pass","label":"README/SKILL.md completeness","detail":"Metadata includes enough usage and workflow context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"info","label":"Permission surface","detail":"filesystem or document access, database access"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern","Outcome loop is ready but needs first real agent run"],"warnings":["Quality score needs review","No real agent outcome reports yet","Human review required before unattended installation"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"Pushed today","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","install":"npx skills add trailofbits/skills --skill audit-context-building","installSafety":"standard package or runtime install path","permissionSurface":"filesystem or document access, database access","documentation":"Strong README/SKILL.md context","agentOutcomes":"No agent outcome data yet","agentProvenScore":0,"outcomeConfidence":"0%","installPolicy":"agent_install_candidate"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill audit-context-building","policy":"agent_install_candidate","label":"Agent install candidate","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","Pushed today","Trust Score v5 requires review or sandbox-only use before install."]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"low","label":"Low metadata risk","notes":["Quality score needs review"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"agent_install_candidate","reason":"Ask for approval or run a sandbox-only trial before installing."},"outcome_loop":{"version":"openagentskill-agent-outcome-v3","required_after_install":true,"endpoint":"/api/agent/outcome","method":"POST","event_id_source":"feedback.event_id, install_receipt.resolve_event_id, or decision_packet.outcome_feedback.event_id","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"required_fields":["event_id","skill_slug","task"],"quality_fields":["task_success","output_quality","error_type","human_review_required","used_in_production","workspace","evidence_url","time_to_useful_ms"],"ranking_inputs_updated":["Trust Score v5 outcome confidence","Agent Proven Score","Resolve ranking task-fit evidence","Skill detail machine-readable metadata","Outcome leaderboard"]},"agent_contract":{"suited_tasks":["security","agent-skill"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"install_command":"npx skills add trailofbits/skills --skill audit-context-building","trust_score":83,"trust_version":"trust-score-v5","risk_level":"low","do_not_use_when":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"before_install":["Read the audit page and machine-readable metadata.","Confirm the install command, license, and permission surface fit the workspace.","Get explicit human approval or choose an alternative before installing."],"after_run":["Report the outcome to /api/agent/outcome using the resolve event id.","Include output_quality, workspace, human_review_required, and evidence_url when available.","Re-resolve before broad production rollout."]},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"knownRisks":["Quality score needs review"],"backward_compatible":{"trust_score_v4":{"version":"trust-score-v4","score":86,"tier":"production","label":"Production candidate","summary":"Strong OpenAgentSkill Trust Score across adoption, recent maintenance, license clarity, documentation, dependency/runtime risk, install safety, permission surface, and install availability."}}},"trust_score_v5":{"version":"trust-score-v5","score":83,"base_score":86,"outcome_confidence":0,"tier":"strong","label":"Review then install","summary":"Good shortlist signal, but the agent should review audit notes, install policy, and outcome evidence before running it.","recommendedAction":"Use as the primary candidate after human or sandbox review.","decision":{"install_policy":"agent_install_candidate","auto_install_allowed":false,"human_review_required":true,"sandbox_first":true,"agent_action":"Ask for approval or run a sandbox-only trial before installing.","reasoning":["83/100 Trust Score v5","86/100 Trust Score v4 baseline","Needs more real agent outcomes before unattended install","Install path is available","Low metadata risk"],"review_required_when":["The workspace contains production secrets, payments, private customer data, or irreversible actions.","The install command requests shell, network, credential, database, or broad filesystem access.","Outcome evidence is missing, recently failed, or required human review.","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"]},"dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"Pushed today"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":86,"weight":0.14,"status":"pass","detail":"Metadata includes enough usage and workflow context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":74,"weight":0.07,"status":"info","detail":"filesystem or document access, database access"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"Pushed today"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"pass","label":"README/SKILL.md completeness","detail":"Metadata includes enough usage and workflow context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"info","label":"Permission surface","detail":"filesystem or document access, database access"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern","Outcome loop is ready but needs first real agent run"],"warnings":["Quality score needs review","No real agent outcome reports yet","Human review required before unattended installation"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"Pushed today","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","install":"npx skills add trailofbits/skills --skill audit-context-building","installSafety":"standard package or runtime install path","permissionSurface":"filesystem or document access, database access","documentation":"Strong README/SKILL.md context","agentOutcomes":"No agent outcome data yet","agentProvenScore":0,"outcomeConfidence":"0%","installPolicy":"agent_install_candidate"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill audit-context-building","policy":"agent_install_candidate","label":"Agent install candidate","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","Pushed today","Trust Score v5 requires review or sandbox-only use before install."]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"low","label":"Low metadata risk","notes":["Quality score needs review"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"agent_install_candidate","reason":"Ask for approval or run a sandbox-only trial before installing."},"outcome_loop":{"version":"openagentskill-agent-outcome-v3","required_after_install":true,"endpoint":"/api/agent/outcome","method":"POST","event_id_source":"feedback.event_id, install_receipt.resolve_event_id, or decision_packet.outcome_feedback.event_id","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"required_fields":["event_id","skill_slug","task"],"quality_fields":["task_success","output_quality","error_type","human_review_required","used_in_production","workspace","evidence_url","time_to_useful_ms"],"ranking_inputs_updated":["Trust Score v5 outcome confidence","Agent Proven Score","Resolve ranking task-fit evidence","Skill detail machine-readable metadata","Outcome leaderboard"]},"agent_contract":{"suited_tasks":["security","agent-skill"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"install_command":"npx skills add trailofbits/skills --skill audit-context-building","trust_score":83,"trust_version":"trust-score-v5","risk_level":"low","do_not_use_when":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"before_install":["Read the audit page and machine-readable metadata.","Confirm the install command, license, and permission surface fit the workspace.","Get explicit human approval or choose an alternative before installing."],"after_run":["Report the outcome to /api/agent/outcome using the resolve event id.","Include output_quality, workspace, human_review_required, and evidence_url when available.","Re-resolve before broad production rollout."]},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"knownRisks":["Quality score needs review"],"backward_compatible":{"trust_score_v4":{"version":"trust-score-v4","score":86,"tier":"production","label":"Production candidate","summary":"Strong OpenAgentSkill Trust Score across adoption, recent maintenance, license clarity, documentation, dependency/runtime risk, install safety, permission surface, and install availability."}}},"trust_score_v4":{"version":"trust-score-v4","score":86,"tier":"production","label":"Production candidate","summary":"Strong OpenAgentSkill Trust Score across adoption, recent maintenance, license clarity, documentation, dependency/runtime risk, install safety, permission surface, and install availability.","recommendedAction":"Shortlist for production use, then run a normal repository and dependency review.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"Pushed today"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":86,"weight":0.14,"status":"pass","detail":"Metadata includes enough usage and workflow context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":74,"weight":0.07,"status":"info","detail":"filesystem or document access, database access"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"Pushed today"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"pass","label":"README/SKILL.md completeness","detail":"Metadata includes enough usage and workflow context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill audit-context-building"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"info","label":"Permission surface","detail":"filesystem or document access, database access"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Quality score needs review"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"Pushed today","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","install":"npx skills add trailofbits/skills --skill audit-context-building","installSafety":"standard package or runtime install path","permissionSurface":"filesystem or document access, database access","documentation":"Strong README/SKILL.md context","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill audit-context-building","policy":"agent_install_candidate","label":"Agent install candidate","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","Pushed today"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"low","label":"Low metadata risk","notes":["Quality score needs review"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":true,"sandboxRequired":true,"policy":"agent_install_candidate","reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"knownRisks":["Quality score needs review"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"outcome_stats":null,"safety":{"score":69,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","summary":"Good audit and safety signals with no high-risk permission hints in public metadata.","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_policy":"review","reasons":["Safe-to-try audit","69/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"safe_to_try","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"},{"id":"filesystem","label":"Filesystem access","reason":"Skill may read or write project files, documents, generated artifacts, or local workspace state.","severity":"medium"},{"id":"database","label":"Database access","reason":"Skill may inspect schemas, query databases, or work with persistent stores.","severity":"medium"}],"policy_warnings":["Quality score needs review"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"blocked":false,"human_review_required":true,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","reasons":["Safe-to-try audit","69/100 agent safety score"]},"eval":{"version":"openagentskill-skill-eval-v1","status":"review","score":84,"risk_level":"medium","decision":{"recommendation":"manual_review","reason":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_allowed":false,"policy":"review","human_review_required":true},"blockers":[],"warnings":["Agent safety gate: Good audit and safety signals with no high-risk permission hints in public metadata.","Permission surface: filesystem or document access, database access","Quality score needs review"],"validation_plan":["Inspect repository, README/SKILL.md, license, and recent commits before production use.","Install in an isolated workspace or sandbox with no production secrets available.","Run the smallest representative task and record files touched, commands run, network access, and outputs.","Compare the selected skill against at least one alternative when the eval status is review or failed.","Promote only after the agent reports a successful verification result and unresolved warnings are accepted."],"checks":[{"id":"task_fit","label":"Task fit","status":"pass","score":94,"required_for_auto_install":true,"detail":"Task wording matches this skill metadata.","evidence":["Evaluate audit-context-building before installing it in an agent workflow","security","Workflow automation workflows; Claude Code teams; teams that value GitHub adoption signals"]},{"id":"install_path","label":"Install path","status":"pass","score":92,"required_for_auto_install":true,"detail":"Install handoff is available.","evidence":["npx skills add trailofbits/skills --skill audit-context-building"]},{"id":"install_safety","label":"Install command safety","status":"pass","score":92,"required_for_auto_install":true,"detail":"standard package or runtime install path","evidence":["npx skills add trailofbits/skills --skill audit-context-building"]},{"id":"trust_score","label":"Trust score","status":"pass","score":86,"required_for_auto_install":true,"detail":"Strong OpenAgentSkill Trust Score across adoption, recent maintenance, license clarity, documentation, dependency/runtime risk, install safety, permission surface, and install availability.","evidence":["Production candidate","6.8K GitHub stars","CC-BY-SA-4.0"]},{"id":"audit_score","label":"Audit score","status":"pass","score":89,"required_for_auto_install":true,"detail":"Safe to try","evidence":["Quality score needs review"]},{"id":"agent_safety_gate","label":"Agent safety gate","status":"warn","score":69,"required_for_auto_install":true,"detail":"Good audit and safety signals with no high-risk permission hints in public metadata.","evidence":["Review the audit page, then allow agent install in a sandboxed workflow.","Safe-to-try audit"]},{"id":"readme_skillmd_completeness","label":"README/SKILL.md completeness","status":"pass","score":86,"required_for_auto_install":false,"detail":"Metadata includes enough usage and workflow context","evidence":["Strong README/SKILL.md context"]},{"id":"license_clarity","label":"License clarity","status":"pass","score":86,"required_for_auto_install":true,"detail":"CC-BY-SA-4.0","evidence":["CC-BY-SA-4.0"]},{"id":"recent_maintenance","label":"Recent maintenance","status":"pass","score":100,"required_for_auto_install":false,"detail":"Pushed today","evidence":["Pushed today"]},{"id":"permission_surface","label":"Permission surface","status":"warn","score":74,"required_for_auto_install":true,"detail":"filesystem or document access, database access","evidence":["Network access: medium","Filesystem access: medium","Database access: medium"]},{"id":"alternatives","label":"Alternatives available","status":"info","score":55,"required_for_auto_install":false,"detail":"No close alternatives were found in the current shortlist.","evidence":[]}],"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-audit-context-building/evals","api":"/api/agent/evals?slug=trailofbits-audit-context-building","text":"/api/agent/evals?slug=trailofbits-audit-context-building&format=text"}},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-audit-context-building","name":"audit-context-building","description":"Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-audit-context-building","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","github_repo":"trailofbits/skills"},"suited_tasks":["Workflow automation workflows","Claude Code teams","teams that value GitHub adoption signals","Move data between tools","Transform files","Trigger repeatable actions","Inspect risky files","Prioritize findings"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill audit-context-building","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.2.1/openagentskill-0.2.1.tgz install trailofbits-audit-context-building"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"audit-context-building\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"audit-context-building\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"audit-context-building\" from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-audit-context-building/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-audit-context-building"},"trust":{"score":86,"label":"Production candidate","version":"trust-score-v4","install_policy":"agent_install_candidate","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"Pushed today","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","install":"npx skills add trailofbits/skills --skill audit-context-building","installSafety":"standard package or runtime install path","permissionSurface":"filesystem or document access, database access","documentation":"Strong README/SKILL.md context","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":true,"sandbox_required":true,"reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":89,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":86,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"Pushed today","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use audit-context-building in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 86/100 Production candidate","Audit: 89/100 Safe to try","Safety: 69/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-audit-context-building (audit-context-building)","install_command":"npx skills add trailofbits/skills --skill audit-context-building","risk_summary":"Safe to try; Reviewed; Low metadata risk","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-audit-context-building","task":"Use audit-context-building in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-audit-context-building","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-audit-context-building","audit":"https://www.openagentskill.com/skills/trailofbits-audit-context-building/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-audit-context-building&task=Use%20audit-context-building%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20audit-context-building%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20audit-context-building%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-audit-context-building/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-audit-context-building"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-audit-context-building","name":"audit-context-building","description":"Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-audit-context-building","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","github_repo":"trailofbits/skills"},"suited_tasks":["Workflow automation workflows","Claude Code teams","teams that value GitHub adoption signals","Move data between tools","Transform files","Trigger repeatable actions","Inspect risky files","Prioritize findings"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill audit-context-building","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.2.1/openagentskill-0.2.1.tgz install trailofbits-audit-context-building"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"audit-context-building\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"audit-context-building\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"audit-context-building\" from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-audit-context-building/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-audit-context-building"},"trust":{"score":86,"label":"Production candidate","version":"trust-score-v4","install_policy":"agent_install_candidate","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"Pushed today","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","install":"npx skills add trailofbits/skills --skill audit-context-building","installSafety":"standard package or runtime install path","permissionSurface":"filesystem or document access, database access","documentation":"Strong README/SKILL.md context","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":true,"sandbox_required":true,"reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":89,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":86,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"Pushed today","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use audit-context-building in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 86/100 Production candidate","Audit: 89/100 Safe to try","Safety: 69/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-audit-context-building (audit-context-building)","install_command":"npx skills add trailofbits/skills --skill audit-context-building","risk_summary":"Safe to try; Reviewed; Low metadata risk","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-audit-context-building","task":"Use audit-context-building in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-audit-context-building","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-audit-context-building","audit":"https://www.openagentskill.com/skills/trailofbits-audit-context-building/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-audit-context-building&task=Use%20audit-context-building%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20audit-context-building%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20audit-context-building%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-audit-context-building/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-audit-context-building"}},"supply_profile":{"track":{"slug":"coding","label":"Coding and developer agents","shortLabel":"Coding","description":"Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills."},"scenario":{"label":"Coding agents","description":"I need a coding agent that can understand a repository, edit code, and review pull requests.","useCases":[{"slug":"workflow-automation","title":"Workflow automation"},{"slug":"security-compliance","title":"Security and compliance"},{"slug":"coding-agents","title":"Coding agents"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill audit-context-building","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6823,"starsLabel":"6.8K","forks":585,"license":"CC-BY-SA-4.0","qualityScore":86,"trustScore":86,"auditScore":89},"maintenance":{"status":"fresh","label":"Pushed today","daysSincePush":0,"lastPushedAt":"2026-08-24T13:20:11+00:00"},"risk":{"level":"safe_to_try","label":"Safe to try","requiresReview":true,"notes":["Quality score needs review"]},"coverageTags":["Coding","Coding agents","security","agent-skill"]},"audit":{"audit_score":89,"risk_level":"safe_to_try","risk_label":"Safe to try","quality_score":86,"trust_score":86,"maintenance_score":100,"security_score":87,"install_score":92,"warnings":["Quality score needs review"]},"quality_signals":{"model":"v2","star_score":26.84,"usage_score":0,"review_score":5.55,"metadata_score":3,"freshness_score":15},"platforms":["Claude Code"],"use_cases":[{"slug":"workflow-automation","title":"Workflow automation","url":"https://www.openagentskill.com/use-cases/workflow-automation"},{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"browser-automation","title":"Browser automation","url":"https://www.openagentskill.com/use-cases/browser-automation"}],"stacks":[{"slug":"content-growth-agent","title":"Content growth agent","url":"https://www.openagentskill.com/collections/content-growth-agent"},{"slug":"coding-review-agent","title":"Coding review agent","url":"https://www.openagentskill.com/collections/coding-review-agent"},{"slug":"browser-qa-agent","title":"Browser QA agent","url":"https://www.openagentskill.com/collections/browser-qa-agent"}],"install":"npx skills add trailofbits/skills --skill audit-context-building","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.2.1/openagentskill-0.2.1.tgz install trailofbits-audit-context-building","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"audit-context-building\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"audit-context-building\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"audit-context-building\" from https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-audit-context-building\",\"task\":\"Install audit-context-building\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","urls":{"web":"https://www.openagentskill.com/skills/trailofbits-audit-context-building","repository":"https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building","api":"/api/agent/skills/trailofbits-audit-context-building","install_api":"/api/skills/trailofbits-audit-context-building/install"},"meta":{"created_at":"2026-08-24T13:23:23.626087+00:00","updated_at":"2026-08-24T13:23:23.626087+00:00","agent_friendly":true}}