# Code Audit Finding

> DeepAudit Finding overlay for source-code auditing with code-audit-main references, mandatory reading routes, and progressive WooYun disclosure.

- Skill: `larlarua/code-audit-finding` (Agent Skill, multi-file: 117 files)
- Install (CLI): `npx skillmds@latest add larlarua/code-audit-finding`
- Raw SKILL.md: https://api.skillmd.com/api/skills/larlarua/code-audit-finding/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: larlarua (https://skillmd.com/u/larlarua)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/larlarua/code-audit-finding

---


# Code Audit Finding Overlay

This skill adapts the `code-audit-main` knowledge base for DeepAudit's `Finding` agent.

Use this skill to strengthen source-code auditing for:
- authorization and access-control flaws
- IDOR and tenant-isolation issues
- business-logic and state-machine flaws
- file operations and path handling
- input-validation gaps
- attack-chain driven source-to-sink review

This skill keeps DeepAudit's current role split intact:
- `recon` provides project navigation and scope
- `finding` produces source-audit conclusions
- `verification` performs follow-up validation

## Required Startup Protocol

1. Read this `SKILL.md` first with `load_skill_body`.
2. Use `skill_resource_lookup(mode="list")` before opening a new reference directory family.
3. Use `skill_resource_lookup(mode="read")` for every required file you rely on.
4. Do not claim a checklist, framework rule, control requirement, or case pattern unless you have actually read the corresponding file.

## Fixed-First Reading Order

After reading this `SKILL.md`, always read these files first:
- `references/core/anti_hallucination.md`
- `references/core/false_positive_filter.md`
- `references/checklists/coverage_matrix.md`
- `references/core/comprehensive_audit_methodology.md`
- `references/core/data_flow_methodology.md`
- `references/core/taint_analysis.md`

## Conditional Mandatory Reading

After the fixed-first set, route by project signals:

- Languages:
  - `references/checklists/<language>.md`
  - `references/languages/<language>.md`
- Frameworks:
  - `references/frameworks/<framework>.md`
- Security domains:
  - `references/security/authentication_authorization.md`
  - `references/security/business_logic.md`
  - `references/security/file_operations.md`
  - `references/security/input_validation.md`
  - `references/security/api_security.md`
  - `references/security/race_conditions.md`
  - plus other matching files under `references/security/`
- Control verification:
  - `references/adapters/<language>.yaml`

## Finding-Specific Constraints

- Audit must stay evidence-driven.
- Cases and historical vulns can guide search direction, but they never count as evidence.
- If you have not read the relevant reference file, do not say that topic is fully audited.
- If you want to claim a missing control at high confidence, read the matching adapter first.
- Use the references to guide code reading, not to replace code reading.

## Progressive Disclosure for WooYun and Cases

Use four levels of disclosure:

1. Default:
   - do not preload WooYun case bodies
2. Index first:
   - read `references/wooyun/INDEX.md`
3. Evidence-gated expansion:
   - only after you already have project-specific code evidence may you read one or two related case files
4. Strict evidence boundary:
   - WooYun and real-world cases only expand search directions, bypass ideas, and missed-check hints
   - they do not justify a finding on their own

Relevant case sources:
- `references/wooyun/`
- `references/cases/real_world_vulns.md`

## Intentionally Excluded From Required Runtime Flow

`agent.md` is preserved in this skill root for reference, but its deep multi-agent orchestration is not part of Finding's required runtime reading path.

The original upstream `SKILL.md` is preserved at:
- `references/core/original_skill_reference.md`