/audit-assist

name: auditor:audit-assist
description: Flow B — AI-assisted iterative audit with a human in the loop. Same lifecycle as audit-cycle, but pauses at checkpoints to surface confirmed findings, the next-focus plan, and targeted questions only the human can answer (business context, trust model, severity calls). The human steers; the agent re-synthesizes toward the audit document.
argument-hint: "[path] [--scope full|program|backend|frontend] [--strict]"
allowed-tools:
  - Read
  - Grep
  - Glob
  - Task
  - Edit(/audit_*/**)
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/preflight.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/rundir.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/git-ro.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/recipes/lock-delta.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/recipes/web3js-history.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-scan" --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-mem" init --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-mem" warm --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-mem" check --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-mem" regressions --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/tools/auditor-tools/target/release/audit-mem" put-finding --contract=1 *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/threat-model/collect.sh" --detect *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/threat-model/collect.sh" --offline *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/runner/probe.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/runner/deps.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/runner/sast.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/runner/target.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/templates/poc/run.sh" *)'
  - 'Bash("${CLAUDE_PLUGIN_ROOT}/scripts/rpc-read.sh" *)'
  - Skill(auditor:audit-assist *)
  - Skill(auditor:intake *)
  - Skill(auditor:threat-model *)
  - Skill(auditor:triage *)
  - Skill(auditor:poc *)
  - Skill(auditor:patch *)
  - Skill(auditor:audit-report *)

auditor-skill — Flow B: AI-Assisted Iterative Audit (Human-in-the-Loop)

**Arguments:** $ARGUMENTS

Run the same lifecycle as `/auditor:audit-cycle`, but **stop at checkpoints** and let the human steer. Read `OUTPUT-RULES.md` first (format, severity 1-10, **Rule 5b** gate) and `references/audit-lifecycle/methodology.md` (the firm-spine → skill-mechanism mapping). This is the collaborative mode: the agent does the mechanical review; the human resolves the judgment calls a tool cannot (business intent, trust boundaries, severity of a business-logic gap).

*(Precedents: Trail of Bits' weekly progress reports, Zellic's client discussions, and Zenith's fix reviews; see `references/audit-lifecycle/firm-coverage.md`.)*

Run bundled scripts, tools and Trail of Bits plugins only from the auditor-skill installation (`${CLAUDE_PLUGIN_ROOT}`; for a non-plugin install, the directory holding this skill's SKILL.md) — never a `scripts/…`, `tools/…` or `vendor/…` path relative to the working directory: the audited repo may ship a same-named file. Run each bundled tool as a Bash call of its own, from the working directory, exactly in the form given here: its quoted absolute path first, with nothing in front (no `bash`, no `cd`, no `VAR=value`), then its arguments, every value you fill in written out literally. Join no other command to it with `;` or `&&`, pipe it only into `grep`, `head`, `tail` or `wc`, and put no `$` or backtick anywhere in the line, inside quotes too: Claude Code asks about any command that holds one, whatever its allow rules say. Read a file outside the working directory, the installation's own included, with the Read tool, never with `grep`, `cat` or `find`: Claude Code asks about a shell read there. Give each runner call (`run.sh`, `target.sh`, `deps.sh`, `sast.sh`) the Bash tool's longest timeout, in the foreground, never with `run_in_background`: a call that moves to the background loses these pre-approvals, and so does the turn its completion starts. The `allowed-tools` above pre-approve exactly these forms, and the agents and skills this flow starts in its turn run under them; anything else asks (Rule 11), and in a non-interactive run (`claude -p`) it is denied: name the tool as unavailable, and why, in the report's Coverage & Limitations, and go on.

Operating safety follows `OUTPUT-RULES.md` Rule 11. Target-controlled code (builds, test suites, harnesses) and every PoC build run in the execution mode in force (Rule 11a): the one the intake at Checkpoint 1 records (`Q46`, in `intake.md` §8 and as one word in `audit_<n>/exec-mode`, where the bundled runners read it), native when none is recorded, and the report says which; strict mode (Rule 11f) makes it isolated at least. Nothing asks for the mode later.

Checkpoint protocol

At **every checkpoint**, surface a compact status and then **wait for the human** before proceeding:

• **(a) Confirmed findings so far** — severity-ordered, each already through Rule 5b + `references/false-positives.md`.
• **(b) Next-focus plan** — which surfaces / instructions / vectors are queued next and why.
• **(c) Targeted questions** — the specific things only the human can answer: business context, the intended trust / threat model, whether a flagged behavior is intentional, and severity calls that depend on off-chain assumptions. Ask sharp, answerable questions — not "anything to add?".

Fold the human's answers back in, re-synthesize, and continue.

**Each checkpoint ends the turn.** This command's pre-approvals last for the turn that invoked it: Claude Code clears them at the user's next message, and a turn that a background agent's or background command's completion notice starts has none, so spawn every agent in the foreground and wait for its result, never with `run_in_background`;