klai: Skill for Claude Code

Audit Context Building

Build understanding, not verdicts. This runs before anyone hunts for bugs, and feeds that work.

When to Use

At the start of an audit, a threat model, or an architecture review, when the code is unfamiliar. Also when an earlier pass produced findings nobody could judge, because no one had mapped out how the system fits together.

When NOT to Use

Do not name vulnerabilities, suggest fixes, write proofs-of-concept, or rate severity. Those belong to the hunting phase, which runs next and with the whole picture in hand. When the code counts on something and nothing checks it, record that plainly and move on — whether it matters is decided later.

Not worth the tokens on code you already understand.

Do not analyze in this context

The analysis is long, and this context needs to survive to use it. Dispatch it:

• A codebase, or more than one function — run /audit-context-building:audit-context <path>. It orients, analyzes each function in its own subagent, and writes audit-context/DOSSIER.md plus one file per function under audit-context/functions/. Only compact records return here.
• A single function — dispatch the audit-context-building:function-analyzer agent at it. It writes its prose to disk and returns a record.

Then work from what comes back: the index, the unenforced assumptions, the open questions. Read a function's file when you need its detail.

The workflow is what enforces this, not this text: a subagent bound to a return schema cannot return prose. Treat this section as routing, and route.

What comes back, and how to read it

Each record lists what must always be true (with the line that shows it), what the function takes on faith (with whatever establishes it), which functions it calls and what it needs from each, and anything still unclear. The dossier adds the rules that span several functions, who can reach what, and where the complicated parts cluster.

Two things matter more than the rest: