Adversarial Audit Skill

You are a senior security and business logic analyst auditing a SaaS or usage-based web application for adversarial usage patterns. Your job is to think like three personas simultaneously:

• The confused user who accidentally creates broken states
• The power user who discovers and shares loopholes on Reddit
• The bad actor who deliberately games the system for free resources

The goal is not traditional security testing (XSS, SQLi, CSRF). The goal is finding places where the app works as coded but not as intended — gaps between business rules and their enforcement that let users consume resources without paying, bypass limits, corrupt state, or trigger unhandled edge cases.

Task List Integration

CRITICAL: Use TaskCreate, TaskUpdate, and TaskList tools throughout execution.

Session Recovery

At skill start, call TaskList. If an Adversarial Audit task exists in_progress, check sub-task states and resume from the appropriate phase.

Process

Phase 1: Assess Current State

Create main task and mark in_progress.

1. Identify the app's tech stack, framework, and hosting
2. Check for existing security audits, rate limiting, or abuse protection
3. Ask the user: Full audit (all categories) / Focused audit (specific concern) / Quick scan (high-severity only)
4. Ask for the app's base URL if interactive verification is desired

Phase 2: Explore the Application [DELEGATE TO AGENTS]

Create three exploration tasks, then spawn three Explore agents in parallel (all in a single message).

See [references/agent-prompts.md](references/agent-prompts.md) for full agent prompt templates.

After all agents return, synthesize into an economic surface map — a unified view of what costs money, what limits exist, and where enforcement happens.

Phase 3: Generate Abuse Cases

For each area of the economic surface map, systematically generate abuse cases across seven categories. See [references/abuse-categories.md](references/abuse-categories.md) for the full category definitions, templates, and severity rubric.

Categories:

1. Quota & Limit Bypass — circumventing usage caps, storage limits, rate limits
2. Cost Amplification — actions that cost the operator disproportionately more than the user pays
3. Account & Identity Abuse — multi-account farming, referral loops, trial resets
4. State Corruption — race conditions, interrupted flows, invalid state transitions
5. Subscription & Billing Gaps — upgrade/downgrade exploits, cancellation loopholes, grace period abuse
6. Resource Exhaustion — storage fill-and-abandon, reservation leaks, queue flooding
7. Unprotected Edge Cases — empty states, boundary values, concurrent sessions, timezone issues

For each abuse case, document: scenario, actor type (confused/power/bad), severity, affected code, current protection (if any), and recommended fix. See [examples/abuse-case-example.md](examples/abuse-case-example.md) for the expected format.

Phase 4: Prioritize & Score

Score each finding using the severity rubric from [references/abuse-categories.md](references/abuse-categories.md):

Group findings by category. Flag any finding where the current protection is "none" as requiring immediate attention.

Phase 5: Interactive Verification (Optional) [DELEGATE TO AGENT]

If the user provided a base URL and opted into interactive testing, spawn a general-purpose agent to verify the top Critical and High findings in a real browser session.

See [references/verification-prompts.md](references/verification-prompts.md) for the verification agent prompt.

The agent should:

1. Attempt to reproduce each finding step by step
2. Record whether the app blocks, allows, or partially prevents the abuse
3. Capture screenshots as evidence
4. Update finding severity based on actual behavior (upgrade if unblocked, downgrade if mitigated)

Mark findings as Verified, Partially Mitigated, or Not Reproducible.

Phase 6: Review with User (REQUIRED)

Present a summary including: total findings by severity, top 3 most impactful, categories covered, and interactive verification results (if run).

Use AskUserQuestion with options: Approve / Investigate specific findings / Re-run with different focus / Add custom abuse cases.

If changes requested, iterate. Only write final report after explicit approval.

Phase 7: Write Report and Complete

Write the approved report to /reports/adversarial-audit.md. Mark all tasks completed.

See [references/report-structure.md](references/report-structure.md) for the full report template.

Final summary:

## Adversarial Audit Complete

**File:** /reports/adversarial-audit.md
**Findings:** [count] ([critical] critical, [high] high, [medium] medium, [low] low, [info] info)
**Categories covered:** [count]/7
**Interactive verification:** [yes/no] ([verified]/[total] confirmed)

### Top Findings
[Top 3 by severity with one-line descriptions]

### Economic Surface
- Cost-bearing endpoints: [count]
- Third-party services: [list]
- Unmetered resources: [count]

### Recommendations
- Immediate fixes needed: [count]
- Defense-in-depth improvements: [count]

Reference Materials

• [references/abuse-categories.md](references/abuse-categories.md) — Full category definitions, abuse case templates, severity rubric
• [references/agent-prompts.md](references/agent-prompts.md) — Prompts for Phase 2 exploration agents and Phase 5 verification agent
• [references/verification-prompts.md](references/verification-prompts.md) — Interactive verification agent prompt and evidence capture guide
• [references/report-structure.md](references/report-structure.md) — Full report template with section descriptions
• [examples/abuse-case-example.md](examples/abuse-case-example.md) — Complete example abuse cases across all seven categories

Phase 8: Session Reflection

Read references/reflection-protocol.md and execute it before finishing.