full-audit

What this skill does

# AppSec Full Audit -- Exhaustive Security Review

Launches every framework, every scanner, every specialized tool, and every
red team agent. Produces a comprehensive dated report file. This is the
most thorough analysis available -- it runs everything, omits nothing, and
preserves every subagent's output verbatim.

Unlike `/appsec:run` which selects relevant tools, `full-audit` runs ALL
tools regardless of detected stack. Unlike `/appsec:run` which consolidates
subagent outputs into a unified list, `full-audit` preserves each agent's
raw output as a separate report section.

## Supported Flags

Read [`../../shared/schemas/flags.md`](../../shared/schemas/flags.md) for the
full flag specification.

| Flag | Full Audit Behavior |
|------|---------------------|
| `--scope` | Propagated to all subagents. Default `full` (NOT `changed`). |
| `--depth` | Forced to `expert` for all subagents. Flag is accepted but overridden. |
| `--severity` | Applied only to the summary table. All findings appear in the full report regardless. |
| `--format` | Ignored. Full audit always produces a Markdown report file. |
| `--quiet` | Suppress progress messages. Report content is unchanged. |
| `--explain` | Propagated to subagents; add learning material per finding. |
| `--fix` | Propagated to subagents; each produces fix suggestions inline. |
| `--skip-redteam` | Skip red team phase. Saves time but loses attack chain analysis. |
| `--skip-frameworks <list>` | Skip specific frameworks. Accepts: `owasp`, `stride`, `pasta`, `linddun`, `sans25`, `mitre`. |
| `--output <filename>` | Custom output filename. Default: `<YYYYMMDD>_appsec_report.md`. |

## Workflow

The full audit runs in 5 phases. Phases 1-3 launch subagents. Phase 4
runs red team agents. Phase 5 assembles the report. Each phase must
complete before the next begins (except where noted for parallelism within
a phase).

### Phase 1: Assessment & Scanners (Main Agent)

#### Step 1.1: Resolve Scope

Default scope is `full` (the entire codebase). Parse flags and resolve to a
concrete file list. For `--scope full`, enumerate all tracked files:

```
git ls-files
```

Filter out binary files, images, and vendored dependencies.

#### Step 1.2: Detect Stack & Scanners

Run the same detection as `/appsec:start` Steps 1-4:
- Detect languages, frameworks, databases from manifests.
- Detect architecture patterns and data sensitivity.
- Detect installed scanners via `which` commands.

#### Step 1.3: Run All Detected Scanners

Run every detected scanner in parallel Bash calls within a SINGLE response.
Use invocation patterns from
[`../../shared/schemas/scanners.md`](../../shared/schemas/scanners.md).

Before launching scanners, create the output directory:

```bash
mkdir -p reports/appsec/scanners
```

Redirect ALL scanner output to files -- the main agent NEVER reads scanner
JSON content.

**Scanner dispatch pattern:**

```bash
# Run each scanner in parallel Bash calls — redirect output to files
semgrep scan --config auto --json --quiet <scope_path> > reports/appsec/scanners/semgrep.json 2>&1
gitleaks detect --source <scope_path> --report-format json --no-banner > reports/appsec/scanners/gitleaks.json 2>&1
npm audit --json > reports/appsec/scanners/npm-audit.json 2>&1           # if Node.js project
pip-audit --format json > reports/appsec/scanners/pip-audit.json 2>&1    # if Python project
trivy fs --format json <scope_path> > reports/appsec/scanners/trivy.json 2>&1   # if installed
```

After ALL scanners complete, check exit codes and file sizes ONLY. Do NOT
read or parse scanner JSON files in the main agent context.

```bash
# Check each scanner result — exit code + file size only
ls -l reports/appsec/scanners/*.json
```

Build a scanner status list from exit codes and file sizes:

- **Exit code 0 or 1 AND file size > 0**: Mark as `OK`.
- **Exit code > 1 AND file size > 0**: Mark as `PARTIAL (ran with warnings)`.
- **File size 0 or file missing**: Mark as `FAILED (no output)`.
- **Exit code 127 (command not found)**: Mark as `MISSING`.

**Error handling for scanners:**

- **Non-zero exit code**: Many scanners exit non-zero when they find issues
  (e.g., `npm audit` exits 1 when vulnerabilities exist). This is normal.
  Only treat it as a failure if the output file is empty (0 bytes).
- **Timeout**: If a scanner does not return within 120 seconds, skip it
  and note the timeout. Mark as `FAILED (timeout)`.
- **Scanner not found**: If a scanner from the plan is not installed (exit
  code 127), note it in `SCANNERS MISSING` and continue.
- Track all scanner statuses for the report assembler:
  ```
  scanner_status = []  # list of {scanner, status, file_path, file_size}
  ```

### Phase 2: Framework Analysis (Parallel Subagents)

Launch framework dispatchers as parallel subagents. The OWASP, STRIDE,
LINDDUN, and specialized tool subagents run in parallel. PASTA runs
sequentially (its stages are chained).

**CRITICAL**: All parallel Task tool calls MUST appear in the SAME response
message. This is what triggers concurrent execution.

Before dispatching, create the output directory:

```bash
mkdir -p reports/appsec/skills
```

#### Parallel Batch 1: OWASP + STRIDE + LINDDUN + Specialized + SANS/CWE + MITRE

Launch ALL of the following as parallel Task calls in ONE response:

**OWASP Top 10 (10 subagents):**

| Category | Skill | Description |
|----------|-------|-------------|
| A01 | `skills/access-control/SKILL.md` | Broken Access Control |
| A02 | `skills/crypto/SKILL.md` | Cryptographic Failures |
| A03 | `skills/injection/SKILL.md` | Injection |
| A04 | `skills/insecure-design/SKILL.md` | Insecure Design |
| A05 | `skills/misconfig/SKILL.md` | Security Misconfiguration |
| A06 | `skills/outdated-deps/SKILL.md` | Vulnerable Components |
| A07 | `skills/auth/SKILL.md` | Auth Failures |
| A08 | `skills/integrity/SKILL.md` | Integrity Failures |
| A09 | `skills/logging/SKILL.md` | Logging Failures |
| A10 | `skills/ssrf/SKILL.md` | SSRF |

**STRIDE (6 subagents):**

| Letter | Skill | Description |
|--------|-------|-------------|
| S | `skills/spoofing/SKILL.md` | Spoofing |
| T | `skills/tampering/SKILL.md` | Tampering |
| R | `skills/repudiation/SKILL.md` | Repudiation |
| I | `skills/info-disclosure/SKILL.md` | Information Disclosure |
| D | `skills/dos/SKILL.md` | Denial of Service |
| E | `skills/privilege-escalation/SKILL.md` | Elevation of Privilege |

**LINDDUN (7 subagents):**

| Category | Skill | Description |
|----------|-------|-------------|
| L | `skills/linking/SKILL.md` | Linkability |
| I | `skills/identifying/SKILL.md` | Identifiability |
| N1 | `skills/non-repudiation-privacy/SKILL.md` | Non-repudiation (privacy) |
| D1 | `skills/detecting/SKILL.md` | Detectability |
| D2 | `skills/data-disclosure/SKILL.md` | Data Disclosure |
| U | `skills/unawareness/SKILL.md` | Unawareness |
| N2 | `skills/non-compliance/SKILL.md` | Non-compliance |

**Specialized Tools (up to 6 subagents, as relevant):**

| Tool | Skill | Description |
|------|-------|-------------|
| Secrets | `skills/secrets/SKILL.md` | Hardcoded secrets, leaked credentials |
| Attack Surface | `skills/attack-surface/SKILL.md` | Entry point inventory |
| Data Flows | `skills/data-flows/SKILL.md` | Data flow mapping |

**SANS/CWE Top 25 (1 subagent):**

| Tool | Skill | Description |
|------|-------|-------------|
| SANS25 | `skills/sans25/SKILL.md` | CWE Top 25 analysis |

Launch ALL of these as parallel Task calls in a SINGLE response.

#### Subagent Prompt Template

Each subagent Task call must include a FULLY self-contained prompt.
Subagents get their own isolated context window and cannot see the main
conversation. Subagents write their findings to a file and return ONLY
a one-line status summary.

Use `--depth expert` and `--scope full` hardcoded into every prompt.

```
Analyze the following files for {TOOL_DESCRIPTION} vulnerabilities:

FILES:
{FILE_LIST}

STEP 1: Read the skill definition at:
{ABSOLUTE_PATH_TO_PLUGIN}/skills/{SKILL_NAME}/SKILL.