/full-audit

name: full-audit
description: "[stable] End-to-end security audit with hotspot-aware framework pivots, shared findings.json schema, and CI-friendly workflow flags"
argument-hint: "[path] [--quick] [--top N] [--recent days] [--since-commit sha] [--diff-base ref] [--language go|ts|py|java] [--focus types] [--exclude paths] [--scope name] [--min-severity level] [--suppressions path] [--fail-on severity] [--verify-dynamic] [--json] [--no-interactive] [--incremental] [--generate-pocs] [--no-filter] [--no-semantic-analysis]"
allowed-tools:
  - Bash
  - Glob
  - Grep
  - Read
  - Write
  - TodoWrite
  - Task
  - AskUserQuestion

Comprehensive Security Audit

**One command to audit any codebase, regardless of size.**

/vuln-scout:full-audit /path/to/code

Shared Prompt Fragments

Before executing this command, read these canonical fragments and treat them as the source of truth for phase order, artifacts, and safety defaults:

• `vuln-scout/references/full-audit/phases.md`
• `vuln-scout/references/full-audit/artifact-contract.md`
• `vuln-scout/references/full-audit/safety.md`

The detailed body below is compatibility guidance for Claude Code command execution. If it conflicts with a shared fragment, follow the shared fragment.

This command automatically:

• Detects if codebase is too large for direct analysis
• Creates compressed architecture scope (language-aware)
• Generates system-level threat model
• Writes a persisted audit plan to `.claude/audit-plan.md`
• Records adversarial review rounds in `.claude/review-ledger.json`
• Identifies and audits high-risk modules
• Produces actionable security report

What This Command Does

┌─────────────────────────────────────────────────────────────┐
│                    FULL AUDIT PIPELINE                       │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  Step 0: SIZE CHECK & ARCHITECTURE DISCOVERY                 │
│  └─> Measure tokens, parse docker-compose/supervisord       │
│  └─> Map services, ports, internal connectivity              │
│      < 150k tokens  → Direct audit                          │
│      > 150k tokens  → Architecture-first workflow           │
│                                                              │
│  Step 1: ARCHITECTURE SCOPE (if large)                       │
│  └─> Language-aware compression (Go: 97%, JS/TS: 80%)       │
│                                                              │
│  Step 1.5: FRAMEWORK PATTERN SCAN                            │
│  └─> Next.js Server Actions, Flask SSTI patterns            │
│  └─> Framework-specific security anti-patterns              │
│                                                              │
│  Step 2: THREAT MODEL                                        │
│  └─> STRIDE analysis, DFDs, trust boundaries                │
│                                                              │
│  Step 2.5: AUDIT PLAN + REVIEW                               │
│  └─> Persist strategy, attack surfaces, verification plan    │
│  └─> 3 review angles: coverage, prioritization, mismatch     │
│                                                              │
│  Step 3: MODULE IDENTIFICATION                               │
│  └─> Rank modules by risk, select top N                     │
│                                                              │
│  Step 4: DEEP DIVE AUDIT (per module)                        │
│  └─> Sink search, data flow tracing, finding review loops    │
│  └─> Semgrep + Joern + CodeQL + extended detectors          │
│  └─> Semantic FP checks, cross-tool correlation             │
│  └─> Auto-propagation of verified patterns                  │
│                                                              │
│  Step 4.5: CLAUDE SEMANTIC ANALYSIS                          │
│  └─> AI-native reasoning on unresolved findings             │
│  └─> Exploitability assessment, sanitizer bypass analysis   │
│                                                              │
│  Step 5: CHAIN + TRIAGE                                      │
│  └─> Automated attack chain detection (5 patterns)          │
│  └─> Auto-triage (auth, exposure, test files)               │
│  └─> Business context CVSS adjustment                       │
│                                                              │
│  Step 6: REPORT + ARTIFACTS                                  │
│  └─> Findings with remediation + knowledge graph            │
│  └─> PoC generation for verified findings (optional)        │
│                                                              │
└─────────────────────────────────────────────────────────────┘

---

Usage

Full Audit (Recommended)

/vuln-scout:full-audit /path/to/code

Quick Audit (Skip threat modeling)

/vuln-scout:full-audit /path/to/code --quick

Audit Top 5 Modules (default is 3)

/vuln-scout:full-audit /path/to/code --top 5

Focus on Recent Changes (git-aware)

/vuln-scout:full-audit /path/to/code --recent 30

Prioritizes modules with changes in the last 30 days. New code has higher vulnerability density.

Scan Only Commit Diff (CI-friendly)

/vuln-scout:full-audit . --since-commit abc1234

Deep-dive scoped to files changed since the commit. Threat model still covers full codebase for context.

PR Scan with Quick Mode

/vuln-scout:full-audit . --since-commit abc1234 --quick --json --no-interactive

Fully headless PR gate: scan diff, emit JSON, no prompts.

Specify Language (auto-detected if omitted)

/vuln-scout:full-audit /path/to/code --language go

Saved scope files are context inputs for Claude-side reasoning and threat modeling. When this workflow invokes `scan_orchestrator.py`, it still passes a real source directory or workspace path to the static tools rather than scanning `.claude/scope-*.md` directly.

---

Prerequisites

Validate Dependencies

# C