AutoSkillit: Skill for Claude Code

Defense Standards Audit Skill

Audit the codebase against defense standards derived from historical bug pattern analysis. Each standard represents an architectural lesson learned from real bugs - a guard that prevents an entire class of bugs, not just one instance.

Standards are added here when /design-guards recommends them and the user approves.

When to Use

• User says "audit defenses", "audit defense standards", "check defenses"
• As a periodic health check to catch regressions
• After major refactors to verify guards still hold

Critical Constraints

NEVER:

• Modify any source code files
• Update an existing report - always generate new

ALWAYS:

• Use subagents for parallel exploration (one per standard or group)
• All output goes under temp/audit-defense-standards/ (create if needed)
• Final report: temp/audit-defense-standards/defense_audit_{YYYY-MM-DD_HHMMSS}.md
• Subagents must NOT create their own files - they return findings in their response text only
• Provide file paths and line numbers for violations
• Categorize by severity

---

Defense Standards Template

This skill requires project-specific defense standards. Define them in this section following the format below.

Example Defense Standards

The following examples show common patterns applicable to many codebases. Replace these with project-specific standards derived from your bug pattern analysis.

---

DS-1: Typed Boundaries Over Raw Data Access

Rule: Data crossing component boundaries must pass through typed accessors or validation. No raw dict.get() or unvalidated external input at boundary crossings.

Audit Strategy:

• Find raw dict/JSON access on data crossing component boundaries
• Check that boundary-crossing functions use typed parameters, not Dict[str, Any] or unvalidated strings
• Verify no mutation of caller's data (.pop() on function parameters)
• Look for direct external input consumption without schema validation

Severity: HIGH