skills/scribe/SKILL.md
Technical writing for formal security audit reports. Use when the user wants to write up a security finding, create a formal issue report, or draft system overview and security model sections for an audit report.
npx skillsauth add artifex1/auditor-addon scribeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
<style_guide>
_validateCallerBalance").<capability_instructions>
<issue_instructions>
TRIGGER: User requests a formal audit issue write-up.
Goal: Generate a formal audit issue write-up.
Rules:
### Title in Title Case. No further sub-headings in the body.git rev-parse HEAD to get the hash.[Context](https://github.com/.../blob/<commit>/<path>#L<line>).Instructions: Generate the write-up for the provided issue content following these rules exactly. First find the commit hash, then write. </issue_instructions>
<intro_instructions>
TRIGGER: User requests System Overview and Security Model sections for an audit report.
Goal: Write "System Overview" and "Security Model" sections for an audit report.
Output Structure:
## System Overview
### ComponentName) for separate parts (modules, services, packages).## Security Model and Trust Assumptions
Instructions: Generate these sections based on the provided system context. </intro_instructions> </capability_instructions>
development
Analyzing codebases to systematically identify and categorize potential security threats, producing a threat model report before code-level auditing. Use when starting an engagement and wanting to map the attack surface, identify high-value assets, and enumerate threat agents before diving into code-level analysis.
development
Conducting interactive security audits using the Map & Probe methodology. Use when the user wants to perform a security review of source code, find vulnerabilities, audit a codebase, or analyze code for security issues.
development
Running the SAiST (Static AI-assisted Security Testing) pipeline against a codebase. Use when the user wants to run static analysis rules, detect code smells, find vulnerability patterns, or scan code with the built-in rule engine. Covers the full init → resolve gaps → run rules flow.
development
Writing SAiST static analysis rules — both shipped rules in the auditor-addon repo and custom per-engagement rules in audit workspaces. Use when the user wants to create a new detection rule, add a security check, implement a code smell detector, turn a confirmed finding into a reusable rule, or extend the rule set. Covers rule types (shallow, deep, MapRule), the trait system, language scoping, finding kinds, custom rules, and testing patterns.