deep-app-audit
Installation
SKILL.md
Deep app audit
This skill audits one Frappe app checkout on three tracks and writes one report:
| Track | Prompts | Id prefix |
|---|---|---|
| Security | the scopes in the area directories of security/ |
S-A to S-L |
| Security | the posture checks in security/checks/ |
S-P |
| Correctness | the rules in quality/B-correctness/ |
Q-B |
| Customization | the rules in quality/A-customization/ |
Q-A |
| Customization | the checks in quality/checks/ |
Q-K |
The id of a prompt is its track prefix and its file id: security/A-authorization/A02-*.md is
S-A02. quality/mechanisms/ is background for the quality rules, not a set of prompts.
Both tracks work the same way. security/_conventions.md and quality/_conventions.md have the
same sections, and each one is the contract for its track: the method, the finding bar, the
severity ladder, the verification steps, and the finding format. The task prompts in prompts/
are the same for both tracks, and they point each agent to the conventions of its track.