# Audit Skill Chain

- **Graph:** https://forefy.com/graphs/89561a02-c0e4-4934-b201-eab30665867b
- **Graph (JSON):** https://forefy.com/api/di3/public/graphs/89561a02-c0e4-4934-b201-eab30665867b

## Run this with your agent

Ask your agent: `Install and run the chain from https://forefy.com/graphs/89561a02-c0e4-4934-b201-eab30665867b.md - install each registry entry, then run the steps in order, passing each step's output to the next. Ask me for the target and confirm I'm authorized before any step that touches a live system.`

Or install everything with the pinned script: `curl -fsSL https://forefy.com/api/di3/graphs/89561a02-c0e4-4934-b201-eab30665867b/install | bash` (PowerShell: `irm "https://forefy.com/api/di3/graphs/89561a02-c0e4-4934-b201-eab30665867b/install?shell=powershell" | iex`; `location=project` installs into the current project, `harness=agents` into `.agents/`). MCP servers aren't scripted; the script prints the instruction to give your agent for each.

How an agent runs it:

1. Install every entry below (each from its own page, or all at once with the script).
2. Before starting, ask the user for the target and any inputs the steps need, and confirm they are authorized for any step that touches a live system.
3. Run the steps in order. Entries in the same step can run in parallel. Each step's "after" line says what it consumes, and quoted text is the author's instruction for that hand-off.
4. Free-text points in the flow are part of the plan: the goal is what the chain is for, and a "via" point is a hand-off or checkpoint (wait for everything before it).

## Chain

In order, following the graph's arrows. Entries in the same step don't depend on each other.

**Goal:** Audit codebase for critical vulnerabilities

1. Together ("Preliminary collection"):
   - **audit-scope** (skill) - https://forefy.com/skills/051b9918-2909-4d4b-b289-0312c03549d1: Draft a security-audit scope from GitHub repos or API access, with a protocol narrative and a sizing table. Use when scoping a new engagement.
   - **pre-bounty** (skill) - https://forefy.com/skills/18c3e623-cf91-4992-a51c-d83815c1147c: Map a bug-bounty scope and rank targets by payout, crowding, and freshness. Use to size up a program or decide where to hunt before committing time.
2. **tiny-auditor** (skill) - https://forefy.com/skills/1c0ebab8-209a-4b29-a92d-840a8da68a5d: Audit codebase to uncover critical issues explicitly without false positives
   - After audit-scope + pre-bounty: "Start auditing code"
3. Together (after tiny-auditor: "Suggest PASSIVE existing or build new nuclei templates for applicative scan"; "Use full burp interaction for reality checks and reproducibles"):
   - **burp-interaction** (skill) - https://forefy.com/skills/4b232fe0-83e2-4edc-9054-c3956a758f52: Interacting with BurpSuite over the reburp extension that exposes the full Montoya API as a local REST API. Use when driving Burp programmatically - reading proxy history, sending HTTP requests throug...
   - **nuclei-suggest** (skill) - https://forefy.com/skills/87b50395-f6aa-4dde-8a00-560de2f59c87: Browse the nuclei-templates library, recommend a scoped template set for a given stack, target, or CVE, then run it against an authorized target and report findings.
4. **bug-bounty-triage** (skill) - https://forefy.com/skills/b7a1cfae-3fbb-40c6-8a74-053bb6844472: Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding is submittable, needs to escalate severity for ma...
   - After burp-interaction + nuclei-suggest, via "Report Draft": "Triage actual important issues only"; "Exploitable issues vulnerability reports"
5. Together (after bug-bounty-triage: "Make report concise and with no AI signs"; "Draw attacker story diagrams"):
   - **archify** (skill) - https://forefy.com/skills/5862895c-8516-4bb0-b055-09be35c21cb5: Create polished, validated architecture, workflow, sequence, data-flow, and lifecycle/state diagrams as explorable standalone HTML with inline SVG, dark/light themes, optional trace motion, and PNG/JP...
   - **no-aispeak** (skill) - https://forefy.com/skills/5d72b0de-53c5-4382-90ed-a356b4be9df9: Generate textual content as the user will normally write without the disliked common AI way of writing
6. **evidence-video** (skill) - https://forefy.com/skills/c90dee70-c5c8-44df-8b07-3aa8f5029ace: Turn a user story or a bug reproduction into a short, evidence-backed walkthrough video where every scene is a real capture, hash-chained so nothing can be faked, and the ending discusses insight, imp...
   - After archify + no-aispeak, via "Wait until all done": "Create PoC videos per each critical validated issue, use report and architectural attacker flows"

## Diagram

- audit-scope -> tiny-auditor: Start auditing code
- pre-bounty -> tiny-auditor
- tiny-auditor -> burp-interaction: Use full burp interaction for reality checks and reproducibles
- Audit codebase for critical vulnerabilities -> audit-scope: Preliminary collection
- Audit codebase for critical vulnerabilities -> pre-bounty
- tiny-auditor -> nuclei-suggest: Suggest PASSIVE existing or build new nuclei templates for applicative scan
- burp-interaction -> Report Draft
- nuclei-suggest -> Report Draft: Exploitable issues vulnerability reports
- Report Draft -> bug-bounty-triage: Triage actual important issues only
- bug-bounty-triage -> archify: Draw attacker story diagrams
- bug-bounty-triage -> no-aispeak: Make report concise and with no AI signs
- archify -> Wait until all done
- no-aispeak -> Wait until all done
- Wait until all done -> evidence-video: Create PoC videos per each critical validated issue, use report and architectural attacker flows
- burp-interaction -> github.com/forefy/reburp: fetches
- nuclei-suggest -> github.com/projectdiscovery/nuclei: fetches