cyber-audit

Determine whether this machine is exposed to one named advisory, and leave a written audit trail.

Hard rules

• Read-only on the machine. You diagnose; the user remediates. No installs, removes, upgrades, restarts, config changes, or file writes outside ~/security-audits/. Reading the advisory is expected: fetch it from authoritative sources, or use the full text the user provided.
• No sudo.
• Record a check that needs a state-changing command as "not checked (would require state change)" instead of running it.
• One report per invocation, even for "Not affected": it is the audit trail.

Workflow