AI agent skill · by @kaivyy

Perseus:Audit

Use when analyzing components for vulnerabilities (Phase 2 - Parallel Analysis)

Archived 2026-10-23 · Source updated 2026-02-23 · License: MIT. Check the original repository for the latest version.

SKILL.md instructions

# Perseus Audit (Phase 2)

## Overview

This skill executes the **Vulnerability Analysis Phase** of the Perseus framework. It performs deep-dive white-box analysis on the components identified during the Scan phase.

**Goal:** Prove the *potential* for exploitation by finding source-to-sink paths lacking proper defense.

**Methodology:**
1.  **Launch 5 Agents in Parallel:** Injection, XSS, Auth, Authz, SSRF.
2.  **Negative Analysis Loop:** Trace Source -> Sanitizers -> Sink -> Verdict.
3.  **Exploit Queue:** Generate actionable vulnerabilities for verification.

## Confidence Scoring (Required)

Assign confidence to every finding:

| Confidence | Criteria |
|------------|----------|
| High | Direct source-to-sink path with clear missing defense and reproducible trigger |
| Medium | Strong path evidence, but one assumption (runtime config/auth state) remains |
| Low | Pattern match only; data flow or trigger path is incomplete |

Prioritize exploit queue in this order:
1. High + Critical/High severity
2. Medium + Critical/High severity
3. Remaining findings

## Execution Instructions

Launch these 5 agents simultaneously using a single message with multiple `Task` tool calls:

1.  **Injection Analyst:**
    *   "Trace untrusted input to SQL/Command sinks. Verify if sanitization matches sink context. Flag string concatenation in queries."
2.  **XSS Specialist:**
    *   "Trace input to browser sinks (`innerHTML`, `eval`). Verify context-aware escaping. Flag raw HTML rendering."
3.  **Auth Specialist:**
    *   "Analyze login/session logic. Check for bypasses, weak tokens, and missing MFA. Verify `state`/`nonce` in OAuth."
4.  **Authz Specialist:**
    *   "Analyze permission checks (RBAC/ABAC). Check for IDOR and Privilege Escalation. Verify every protected route has a guard."
5.  **SSRF Specialist:**
    *   "Trace input to outbound request sinks. Verify URL validation and allowlists. Check for local network access."

## Analysis Methodology (The "Negative Analysis" Loop)

For each agent, enforce this loop:

1.  **Trace Source:** Identify where untrusted data enters (from Scan phase).
2.  **Trace Flow:** Follow variables through functions, middleware, and transforms.
3.  **Identify Sink:** Where does the data end up? (DB, Screen, Log, Shell).
4.  **Verify Defense:**
    *   *Is there validation?* (e.g., `zod.parse`)
    *   *Is there sanitization?* (e.g., `escapeHtml`)
    *   *Is it parameterized?* (e.g., Prepared Statements)
5.  **Verdict:**
    *   **VULNERABLE:** Path exists + Defense missing/mismatched. -> **Add to Exploit Queue**
    *   **SAFE:** Defense is robust. -> **Document as Secure**

## Output Requirements

Each agent must produce a specialized report in `deliverables/`:
*   `injection_analysis.md`
*   `xss_analysis.md`
*   `auth_analysis.md`
*   `authz_analysis.md`
*   `ssrf_analysis.md`

For each finding include:
*   **Finding ID**
*   **Source -> Sink Path**
*   **Missing or Mismatched Defense**
*   **Preconditions**
*   **Confidence:** `High` | `Medium` | `Low`
*   **Exploit Candidate:** `Yes` | `No` (and reason)

**Next Step:** Proceed to `perseus:exploit` to verify findings with Proof-of-Concept.