mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
5010b15ffc
Verified against opencode.ai/docs/skills: project-local search paths are .opencode/skills, .claude/skills and .agents/skills, not configurable. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
1.2 KiB
1.2 KiB
name, description
| name | description |
|---|---|
| openultrasast-fix-audit | OpenUltraSAST patch, fix audit, differential review, adversarial review, and patch validation workflow. Use when proposing or auditing fixes for OpenUltraSAST findings from opencode. |
OpenUltraSAST Fix Audit
Use this skill to steer fixes for OpenUltraSAST findings.
Fix Lifecycle
- Intake: restate the finding ID, evidence level, affected path, and acceptance criteria.
- Plan: choose the smallest defensive change that addresses the root cause.
- Implement: modify only files required by the finding.
- Adversarial review: look for bypasses, regressions, false assumptions, and unrelated edits.
- Reconcile: either fix the review finding or document why it is not applicable.
- Verify: rerun the reproducer or affected checks.
- Ready: only then consider advancing to
patch_validated.
Guardrails
- Do not rewrite modules when a local fix is enough.
- Do not change public APIs unless the vulnerability requires it.
- Do not mark a patch validated from model reasoning alone.
- Use differential review for risky changes in auth, crypto, config, parsers, and sandbox behavior.
- Run Semgrep or CodeQL delta checks when those analyzers supplied the original evidence.