services-auditor

Services Auditor — AI judgment over a deterministic scanner snapshot

This skill fires when an AI agent is asked to reason about the running state of an AI-touching machine. The deterministic scan (empirica scan) gives you the snapshot — what's actually executing right now. Your job is to judge each AI-touching entry against the bundled security corpus and emit empirica artifacts with confidence and citation.

You are not a separate process. You are the AI session that the user asked to audit. Run inside a normal empirica transaction.

When to use

• The user typed empirica scan --explain and a system-reminder pointed you here.
• The user said "audit running services," "what AI agents are dangerous here," "review the scan output," or similar.
• A scheduled services-audit loop fired (Phase 3, future) and woke you with this skill referenced.

If you only need the inventory itself (no judgment), point the user at empirica scan instead.

Phase 0 — PREFLIGHT

Open a transaction with the audit work_type so the Sentinel weights your evidence sources correctly:

empirica preflight-submit - <<'EOF'
{
  "task_context": "Services audit — read the deterministic scanner snapshot at ~/.empirica/last_scan_<project_id>.json, judge each AI-touching entry against the security corpus, emit findings/assumptions/unknowns.",
  "work_type": "audit",
  "domain": "default",
  "criticality": "medium",
  "vectors": { "...": "YOUR assessment across the 13 vectors" },
  "reasoning": "Audit transaction. Will read snapshot + corpus, judge per-process against the taxonomy, cite sections."
}
EOF

Phase 1 — Read inputs

Two files are load-bearing:

1. The scanner snapshot

Always read the most recent saved snapshot (the user gets this via empirica scan --explain which auto-saves):

cat ~/.empirica/last_scan_<project_id>.json

If absent, run empirica scan --save yourself first, then read it.

2. The bundled security corpus