# Perseus:audit

> Use when analyzing components for vulnerabilities (Phase 2 - Parallel Analysis)

- **Type:** Skill
- **Install:** `agentstack add skill-kaivyy-perseus-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kaivyy](https://agentstack.voostack.com/s/kaivyy)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kaivyy](https://github.com/kaivyy)
- **Source:** https://github.com/kaivyy/perseus/tree/main/skills/perseus/audit

## Install

```sh
agentstack add skill-kaivyy-perseus-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Perseus Audit (Phase 2)

## Overview

This skill executes the **Vulnerability Analysis Phase** of the Perseus framework. It performs deep-dive white-box analysis on the components identified during the Scan phase.

**Goal:** Prove the *potential* for exploitation by finding source-to-sink paths lacking proper defense.

**Methodology:**
1.  **Launch 5 Agents in Parallel:** Injection, XSS, Auth, Authz, SSRF.
2.  **Negative Analysis Loop:** Trace Source -> Sanitizers -> Sink -> Verdict.
3.  **Exploit Queue:** Generate actionable vulnerabilities for verification.

## Confidence Scoring (Required)

Assign confidence to every finding:

| Confidence | Criteria |
|------------|----------|
| High | Direct source-to-sink path with clear missing defense and reproducible trigger |
| Medium | Strong path evidence, but one assumption (runtime config/auth state) remains |
| Low | Pattern match only; data flow or trigger path is incomplete |

Prioritize exploit queue in this order:
1. High + Critical/High severity
2. Medium + Critical/High severity
3. Remaining findings

## Execution Instructions

Launch these 5 agents simultaneously using a single message with multiple `Task` tool calls:

1.  **Injection Analyst:**
    *   "Trace untrusted input to SQL/Command sinks. Verify if sanitization matches sink context. Flag string concatenation in queries."
2.  **XSS Specialist:**
    *   "Trace input to browser sinks (`innerHTML`, `eval`). Verify context-aware escaping. Flag raw HTML rendering."
3.  **Auth Specialist:**
    *   "Analyze login/session logic. Check for bypasses, weak tokens, and missing MFA. Verify `state`/`nonce` in OAuth."
4.  **Authz Specialist:**
    *   "Analyze permission checks (RBAC/ABAC). Check for IDOR and Privilege Escalation. Verify every protected route has a guard."
5.  **SSRF Specialist:**
    *   "Trace input to outbound request sinks. Verify URL validation and allowlists. Check for local network access."

## Analysis Methodology (The "Negative Analysis" Loop)

For each agent, enforce this loop:

1.  **Trace Source:** Identify where untrusted data enters (from Scan phase).
2.  **Trace Flow:** Follow variables through functions, middleware, and transforms.
3.  **Identify Sink:** Where does the data end up? (DB, Screen, Log, Shell).
4.  **Verify Defense:**
    *   *Is there validation?* (e.g., `zod.parse`)
    *   *Is there sanitization?* (e.g., `escapeHtml`)
    *   *Is it parameterized?* (e.g., Prepared Statements)
5.  **Verdict:**
    *   **VULNERABLE:** Path exists + Defense missing/mismatched. -> **Add to Exploit Queue**
    *   **SAFE:** Defense is robust. -> **Document as Secure**

## Output Requirements

Each agent must produce a specialized report in `deliverables/`:
*   `injection_analysis.md`
*   `xss_analysis.md`
*   `auth_analysis.md`
*   `authz_analysis.md`
*   `ssrf_analysis.md`

For each finding include:
*   **Finding ID**
*   **Source -> Sink Path**
*   **Missing or Mismatched Defense**
*   **Preconditions**
*   **Confidence:** `High` | `Medium` | `Low`
*   **Exploit Candidate:** `Yes` | `No` (and reason)

**Next Step:** Proceed to `perseus:exploit` to verify findings with Proof-of-Concept.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kaivyy](https://github.com/kaivyy)
- **Source:** [kaivyy/perseus](https://github.com/kaivyy/perseus)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kaivyy-perseus-audit
- Seller: https://agentstack.voostack.com/s/kaivyy
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.