marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-22 06:29:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(skills): .agents/skills -- the plural directory OpenCode searches by default

Browse Source 
Verified against opencode.ai/docs/skills: project-local search paths are
.opencode/skills, .claude/skills and .agents/skills, not configurable.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 19:24:33 +02:00
co-authored by Claude Fable 5.1
parent 69b5e0efcc
commit 5010b15ffc
39 changed files with 0 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agents/skills/openultrasast-fix-audit/SKILL.md
+26
View File
@@ -0,0 +1,26 @@
---
name: openultrasast-fix-audit
description: OpenUltraSAST patch, fix audit, differential review, adversarial review, and patch validation workflow. Use when proposing or auditing fixes for OpenUltraSAST findings from opencode.
---
# OpenUltraSAST Fix Audit
Use this skill to steer fixes for OpenUltraSAST findings.
## Fix Lifecycle
1. Intake: restate the finding ID, evidence level, affected path, and acceptance criteria.
2. Plan: choose the smallest defensive change that addresses the root cause.
3. Implement: modify only files required by the finding.
4. Adversarial review: look for bypasses, regressions, false assumptions, and unrelated edits.
5. Reconcile: either fix the review finding or document why it is not applicable.
6. Verify: rerun the reproducer or affected checks.
7. Ready: only then consider advancing to `patch_validated`.
## Guardrails
- Do not rewrite modules when a local fix is enough.
- Do not change public APIs unless the vulnerability requires it.
- Do not mark a patch validated from model reasoning alone.
- Use differential review for risky changes in auth, crypto, config, parsers, and sandbox behavior.
- Run Semgrep or CodeQL delta checks when those analyzers supplied the original evidence.