# Parsentry

> Use this skill when the user wants a repository-wide or directory-wide security analysis that produces a structured report. It orchestrates parsentry CLI to enumerate attack surfaces, dispatch parallel analysis agents, and generate a PDF report with SARIF findings. Triggers: security scan, security audit, vulnerability scan, threat model, attack surface enumeration, pentest preparation, "parsentry", セキュリティスキャン, 脆弱性分析.

- Skill: `hikaruegashira/parsentry` (Agent Skill, multi-file: 20 files)
- Install (CLI): `npx skillmds@latest add hikaruegashira/parsentry`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hikaruegashira/parsentry/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: HikaruEgashira (https://skillmd.com/u/hikaruegashira)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hikaruegashira/parsentry

---


# Parsentry Scan Orchestrator

Run `parsentry model` → agent writes model.json → `parsentry scan` → parallel agents write SARIF → `parsentry generate` (merges SARIF + renders PDF).

## Phase 1: Threat Model

```bash
MODEL_PROMPT=$(parsentry model <TARGET> 2>/dev/null)
```

Dispatch **one Agent** with `$MODEL_PROMPT` as the prompt verbatim. The prompt already instructs the agent to write `model.json` to the correct cache path — no additional wrapping needed.

**Validate** before proceeding:

```bash
parsentry scan <TARGET> 2>&1 | head -1
# Must NOT say "model.json not found"
```

## Phase 2: Per-Surface Analysis

```bash
SCAN_OUTPUT=$(parsentry scan <TARGET> 2>&1)
```

- If output says **"all N surfaces cached, no analysis needed"** → skip to Phase 3.
- Otherwise, list all `prompt.md` files that have **no** sibling `result.sarif.json`:

```bash
# Parse report paths from parsentry scan output (platform-independent)
parsentry scan <TARGET> 2>&1 | grep '→' | awk '{print $NF}' | while read dir; do
  [ -f "$dir/prompt.md" ] && [ ! -f "$dir/result.sarif.json" ] && echo "$dir"
done
```

Dispatch **all pending surface agents in parallel** (single message, multiple Agent tool calls). Pass each `prompt.md` content verbatim — it already contains surface metadata, source file paths, SARIF schema, and output path.

**Validate** — re-run `parsentry scan <TARGET>` and confirm all surfaces are cached.

## Phase 3: Report

```bash
parsentry generate <TARGET>
```

`generate` merges the per-surface SARIF files into `merged.sarif.json` and renders the PDF in one step. Open the generated PDF path (printed to stdout) and summarize findings to the user.

To file findings as issues instead of (or alongside) a PDF, run `parsentry merge <TARGET> --gh-issue <owner/repo>` (also supports `--jira`, `--linear`, `--notion`, `--min-level`, `--dry-run`).

## Phase 4: Triage (on request)

When the user asks to triage, patch, or fix findings, read [references/triage.md](references/triage.md) for the full workflow.

## Gotchas

- `parsentry model` output goes to **stdout**; progress/logs go to stderr. Always use `2>/dev/null` or `2>&1` intentionally.
- The cache directory is platform-dependent (`~/Library/Caches/parsentry/` on macOS, `~/.cache/parsentry/` on Linux). Let `parsentry scan` resolve paths — don't hardcode.
- Agent prompts from parsentry are self-contained. **Do not** add system prompts or wrap them — pass verbatim.
- `parsentry generate` merges SARIF internally before rendering — no separate `merge` step is required for the PDF. The standalone `parsentry merge` is only for issue-tracker integration (`--gh-issue`/`--jira`/`--linear`/`--notion`).
- If an agent produces invalid SARIF, the merge step skips that surface and logs a warning. Check `generate` output for skipped surfaces.

## Error Handling

- Agent failure → retry that surface **once**
- Rate limit (429/529) → wait with exponential backoff, then retry
- Invalid SARIF → log, skip surface, note in final summary