Octopus Security Audit

Host: Codex CLI — This skill was designed for Claude Code and adapted for Codex. Cross-reference commands use installed skill names in Codex rather than /octo:* slash commands. Use the active Codex shell and subagent tools. Do not claim a provider, model, or host subagent is available until the current session exposes it. For host tool equivalents, see skills/blocks/codex-host-adapter.md.

Execution Contract (MANDATORY - CANNOT SKIP)

This generated Codex skill preserves an enforced workflow contract from the source skill.

PROHIBITED:

• Do not summarize, simulate, or skip the referenced workflow command when this skill requires execution.
• Do not claim provider output or validation artifacts exist without checking the actual files or command output.
• Do not continue silently when a required provider, command, or host capability is unavailable; report the unavailable dependency and use a supported fallback.

Security Audit Skill

Your first output line MUST be: 🐙 **CLAUDE OCTOPUS ACTIVATED** - Security Audit

Invokes the security-auditor persona for thorough security analysis during the ink (deliver) phase. Supports both quick OWASP scanning and full adversarial red/blue team testing.

Usage

# Quick scan via security-auditor persona
${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh spawn security-auditor "Scan for SQL injection vulnerabilities"

# Adversarial red team via squeeze workflow
${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh squeeze "Security audit the authentication module"

# Via auto-routing (detects security intent)
${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh auto "security audit the payment processing module"

Modes (Auto-Detected)

Auto-escalation to Deep mode: The skill automatically switches to Deep mode when ANY of these are true:

• Diff includes files matching: *auth*, *login*, *password*, *session*, *token*, *secret*, *crypt*, *oauth*, *saml*, *jwt*, *permission*, *rbac*, *acl*
• Diff includes CI/CD files: .github/workflows/*, Dockerfile*, docker-compose*, .gitlab-ci*
• Diff includes dependency files: package-lock.json, yarn.lock, Gemfile.lock, requirements.txt, go.sum
• The user explicitly says "deep", "full", "comprehensive", or "CSO"

No user action needed — mode detection happens automatically from the git diff context.

Model Selection Caveat: Fable 5.1

By default, do not dispatch security-audit passes to Claude Fable 5.1 or the preserved Fable 5 ID. Their safety classifiers can refuse adversarial red-team phrasing in authorized audits. Route these passes to OCTOPUS_FABLE5_FALLBACK_MODEL (default claude-opus-5) and keep prompts defensively framed (find and report vulnerabilities; do not request working exploits). Reject an exact model-qualified override that targets claude-fable-5-1 or claude-fable-5. On refusal, retry exactly once on the fallback unless OCTOPUS_FABLE5_NO_RETRY=1; when retries are disabled or the retry refuses, surface the refusal without further dispatches. OCTOPUS_FABLE5_MODE=off is the explicit exception: it disables automatic rerouting for ordinary environment pins, while exact Fable security seats still fail closed. Details: skills/blocks/fable5-prompting.md.

Capabilities

Core (both modes)

• OWASP Top 10 vulnerability detection
• SQL injection and XSS scanning
• Authentication/authorization review
• Secrets and credential detection
• Dependency vulnerability assessment
• Security configuration review

Secrets Archaeology (Deep mode)

Scan git history for leaked credentials that may have been "deleted" but remain in commits:

# Search git history for common secret patterns
git log --all -p --diff-filter=D -- '*.env' '*.key' '*.pem' 2>/dev/null | head -200
git log --all -p -S 'AKIA' --pickaxe-regex 2>/dev/null | head -100  # AWS keys
git log --all -p -S 'sk-[a-zA-Z0-9]{20,}' --pickaxe-regex 2>/dev/null | head -100  # API keys
git log --all -p -S 'ghp_|gho_|github_pat_' --pickaxe-regex 2>/dev/null | head -100  # GitHub tokens
git log --all -p -S 'password\s*[:=]' --pickaxe-regex 2>/dev/null | head -100  # Passwords

Report any findings with the commit SHA, file, and recommendation to rotate the credential.