checking-cchb-security

Checking cchb Security

Repository-specific security audit for the cchb Rust TUI. The attack surface of cchb is local files + subprocess + clipboard, not network — so generic web-app scanners miss what matters here. This skill orchestrates two specialized subagents in parallel and aggregates their findings.

When to Use

• Before opening a PR that touches src/main.rs, src/session.rs, src/event.rs, Cargo.toml, or .github/workflows/*.
• Before cutting a release tag.
• On request: "run a security audit", "cchb security check", "脆弱性チェック".

Do not use this for unrelated repositories — it is hard-coded to cchb's structure.

Pre-flight

Before invoking subagents, verify the working directory is the cchb repo root:

test -f Cargo.toml && grep -q '^name = "cchb"' Cargo.toml

If it fails, abort with: Not in cchb repository root. Aborting.

Also capture environment metadata for the report header:

git rev-parse --short HEAD
git rev-parse --abbrev-ref HEAD
cargo --version
rustc --version
date -u +%Y-%m-%dT%H:%M:%SZ

Workflow

1. Run the pre-flight check above.
2. Launch both subagents in parallel — single message, two Agent tool calls:
   • subagent_type: cchb-code-security-auditor — categories A (subprocess), B (path), C (parsing), D (sensitive data), E (Rust safety), plus H2/H3 (docs).
   • subagent_type: cchb-supply-chain-auditor — categories F (deps with active CVE lookup), G (CI/CD with active GH advisory lookup), plus H1 (SECURITY.md).
3. Each subagent returns findings as a JSON array (schema below).
4. Aggregate, sort by severity (Critical → High → Medium → Low → Info) then by category id.
5. Render the final Markdown report to stdout. Do not write to files (read-only policy).

Subagent prompt template

When invoking each subagent, pass:

• The repository root path (current working directory).
• The git ref captured in pre-flight.
• Instruction: "Return findings as a JSON array conforming to the schema in SKILL.md. Output the JSON array first, then a brief human summary."