v7.6.0 — Detection & response, threat-model bootstrap, GitHub Actions trigger trust, operating safety

Until now every flow assumed the code had not shipped yet. 7.6.0 adds:

• a post-incident track;
• threat models seeded from the target's own history;
• coverage of who can start a privileged CI job;
• written rules for running code and reading git metadata the auditor does not trust;
• a Trail of Bits pin moved after a full review.

It ships as #21, which closes #13–#17 and #35.

Highlights

Detection & response (#14)

• /auditor:hunt (no alert in hand) and /auditor:respond <lead> hand all reading and analysis of the incident corpus to a new incident-responder agent, which has no MCP tools and only proposes containment. Not signing is a rule the agent follows; isolated mode with no keypair mounted is what confines it.
• references/detection-response/: one verdict ladder, log sources, a containment playbook and the INCIDENTS.json schema.
• scripts/dnr/:
  • a read-only, capped RPC collector that runs only once the human approves the addresses, window and caps (or with --collect in non-interactive runs);
  • program snapshots that are never overwritten;
  • profile, log-frame and exact-delta recipes, where values above 2^53 stay exact.
• Reproduction on the incident's own program bytes: templates/poc/run.sh with VULNERABLE_SO reports [PoC-REPRODUCED] only after the contract assertion ran and held on those bytes.

Threat-model bootstrap (#15)

• /auditor:threat-model --bootstrap drafts the model from history before the interview, using:

  • keyword commits and reverts;
  • removed and added account guards;
  • churn;
  • prior audit reports and post-mortems;
  • INCIDENTS.json.

  Every attacker goal carries its evidence.

• A read-only collector, scripts/threat-model/collect.sh, that follows Rule 11c.

GitHub Actions trigger trust (#16)

• references/vuln-classes/github-actions.md covers:
  • comment-triggered commands and per-event author gating;
  • expression and env-file injection;
  • pull_request_target / workflow_run pwn requests, with artifact and cache poisoning;
  • AI coding agents in CI.
• KV-139 and KV-140 (severity 9), DEP-090..096 and AI-034..035. Recipes R1–R8 are tested against 45 fixture workflows.

Operating safety: OUTPUT-RULES Rule 11 (#17)

• 11a Execution mode. Intake asks once (Q46). Isolated is recommended; native is allowed, and the report then says so.
• 11b Outside-service disclosure. The report lists each tool, the service it contacted and what it sent.
• 11c Untrusted git checkouts. Every git command in a checkout the auditor did not create runs with a fixed safe prefix.
• 11d Output hygiene. audit_<n>/, incident_<n>/ and .audit-memory/ ignore themselves.
• 11e Bundled paths. Bundled scripts, tools and templates run from the installation root, never from the working directory.
• Checklist 11 §11.11 Dependency-update review (SC-059..062), and a dependency lane in /auditor:diff-audit and /auditor:re-audit.

PoC harness

• templates/poc/run.sh builds from a scratch copy outside the audited tree with a pinned toolchain.
• Exits 1 and 2 need a contract assertion that ran and did not hold; any other failure is inconclusive.

Trail of Bits pin (#13)

• vendor/trailofbits moves from cfe5d7b to 82fe822 after a delta review with the new read-only scripts/tob-delta-review.sh.
• CI checks the README pin against the gitlink, and Dependabot opens monthly bumps for review. They are never auto-merged.

CI

• corpus-check runs all eight self-test suites.
• actions/checkout is pinned to v7.0.1 by SHA, with persist-credentials: false.

Upgrade notes

• PoC builds need the execution mode. Pass AUDITOR_EXEC_MODE=isolated|native to templates/poc/run.sh. Without it, the script exits 3 before building and the PoC is [PoC-ATTEMPTED]. The commands pass the mode recorded at intake.
• Intake has a new question (Q46). --auto records native as an assumed default, and the report says so.
• Install outside any repository you audit.
  • install.sh warns inside a git work tree.
  • A run without a path never replaces an existing copy.
  • A run with a path moves the earlier install aside.
• Bundled scripts prompt. hunt, respond and threat-model pre-approve no bundled scripts, so running one asks first (#37).
• Live incidents: disconnect or deny write-capable MCP servers first. The commands call none, but they run in your session, where those servers remain callable.
• Who gets the new pin. Plugin users receive it with this release; install.sh users get it on their next install.

Corpus: 20 checklists / 1,446 items / 140 vectors / 13 methodologies / 17 commands / 9 agents.

Credits: all text is our own, with nothing copied. These sources informed it:

• Anthropic's defending-code reference harness (Apache-2.0);
• getsentry/skills gha-security-review (Apache-2.0);
• cloudflare/security-audit-skill (MIT).

See ATTRIBUTION.md.

Trail of Bits skills pin: 82fe822 (82fe8226252622fa807643bdca1710901198553a, trailofbits/skills main of 2026-09-28).

Full diff: v7.5.0...v7.6.0

v7.5.0 — Slot used as a clock after SIMD-0525 / Alpenglow

Backfilled release: this tag was created on 2026-10-22 at the merge commit that released 7.5.0 on 2026-10-20.

Highlights

SIMD-0525 halved mainnet slot time, so any duration a program counts in slots or epochs now passes in half the wall-clock time. Alpenglow also makes Clock.unix_timestamp a leader-set value within a bounded range. This release adds the Solana equivalent of "block number used as a clock" (#20):

• KV-138: slot-denominated time after SIMD-0525, with six verification steps.
• Checks across five checklists:
  • SM-073..074: slot-denominated durations, and tolerance for the leader-set clock;
  • ECON-090..092: slot-rate interest constants, oracle / TWAP windows, and per-slot caps;
  • OPS-086..087: governance timelocks, the blockhash window, and durable nonces;
  • BE-132: keepers that derive wall-clock time from slots;
  • FV-073: tests that assert durations in seconds.
• A staleness-bound note in the lending methodology.

Corpus: 20 checklists / 1,433 items / 138 vectors / 13 methodologies.

Trail of Bits skills pin: cfe5d7b (cfe5d7b1619e47fb5b38b7e2561dad7e5f1e89af), unchanged.

Full diff: v7.4.0...v7.5.0

v7.4.0 — Vendored-program provenance: white-label version drift

Backfilled release: this tag was created on 2026-10-22 at the merge commit that released 7.4.0 on 2026-09-29.

Highlights

Package scanners see library crates, not which version of a vendored or white-label program is actually deployed. This release covers deployed-program provenance (#12):

• KV-137: white-label / vendored on-chain program version drift and the inherited admin surface. It covers drift against upstream and the fleet blast radius, with a five-step verification procedure.
• Checklist 02 §2.7 (AC-051..055): off-chain-signed authority grants, including on-chain signer gating, signed-payload binding, per-element bundle validation and admin-set monitoring.
• Checklist 11 §11.10 (SC-053..058): vendored and white-label programs, including a provenance inventory, a deployed-versus-upstream diff, advisory subscription and a patch SLA, vendor-managed upgrades and sibling-incident monitoring.

Corpus: 20 checklists / 1,424 items / 137 vectors / 13 methodologies.

Trail of Bits skills pin: cfe5d7b (cfe5d7b1619e47fb5b38b7e2561dad7e5f1e89af), unchanged.

Full diff: v7.3.0...v7.4.0

v7.3.0 — Transaction v1 (SIMD-0385) readiness

Backfilled release: this tag was created on 2026-10-22 at the merge commit that released 7.3.0 on 2026-09-08.

Highlights

Transaction v1 (SIMD-0385 / SIMD-0296) is opt-in to send but mandatory to read, and it moves compute limits and the priority fee into the message itself. This release covers that change (#11):

• New playbook, references/vuln-classes/transaction-v1.md: a fact sheet, a who-breaks matrix, invariants V1–V10, per-role worksheets, grep recipes and a test / PoC strategy.
• KV-135 (fee-sponsor cap bypass and disabled ComputeBudget gates) and KV-136 (reader wedge and zero-budget indexing).
• 23 checklist items across on-chain, TypeScript, backend, frontend, deployment, testing, monitoring and off-chain Rust (new §9.18, §13.12 and §20.6).

Corpus: 20 checklists / 1,413 items / 136 vectors / 13 methodologies.

Trail of Bits skills pin: cfe5d7b (cfe5d7b1619e47fb5b38b7e2561dad7e5f1e89af), unchanged.

Full diff: v7.2.0...v7.3.0

v7.2.0 — Web-stack, token-registry and Token ACL coverage; governance and corpus-check CI

Backfilled release: this tag was created on 2026-10-22 at the merge commit that released 7.2.0 on 2026-09-02.

Highlights

Corpus: 20 checklists / 1,390 items / 134 vectors / 13 methodologies

• Web-stack coverage (#7): 44 checklist items for hosted auth providers, API-key issuance, external data-provider integrity, Postgres / ClickHouse, Next.js 16 proxy / Server Actions / RSC, Bun / pnpm / Turborepo, GCP Cloud Run + Terraform, and tracked AI-tooling artifacts.
• Token registries and risk signals (#8): a new methodology, references/methodologies/token-registry-risk.md, with KV-132 (canonical-asset / token-list spoofing and primary-variant hijack) and KV-133 (risk-score / trust-tier farming).
• Token ACL / SRFC-37 (#9): Token-2022 methodology §9 for gate programs, issuers and integrators, invariant T12, and KV-134 (gate-program bypass and permissionless-freeze griefing).

Tooling

• audit-scan (#6) separates init_if_needed from init, records remaining_accounts sites and flags UncheckedAccount fields.

Governance (#10)

• CONTRIBUTING.md, SECURITY.md, a PR template, and a corpus-check CI workflow that checks counts, index links, frontmatter ids, version agreement, repository hygiene and attribution-free commits.

Trail of Bits skills pin: cfe5d7b (cfe5d7b1619e47fb5b38b7e2561dad7e5f1e89af, trailofbits/skills main of 2026-06-30).

Thanks to @frcd10 (#7, #8, #9) and @panditdhamdhere (#6).

Full diff: v7.1.0...v7.2.0

v7.1.0 — Token optimization: leaner floor + evidence-driven progressive disclosure

A deep token-optimization pass with zero/minimal functionality tradeoff. The skill's runtime cost is which markdown enters context, so this trims the always-loaded floor and makes progressive disclosure precise. No check, vector, rule, or item is deleted; nothing is renumbered; the output-side completeness guarantee (Rule 0) is intact.

Highlights

Leaner always-loaded floor (~17.5K → ~14.9K tok, −15%)

• Report-assembly rules (Rule 2/6/8/9 bodies) lazy-split into references/report-format.md, loaded only at report time; OUTPUT-RULES keeps numbered stub headers so every Rule N reference still resolves.
• Removed a duplicated folder-tree, single-sourced the verbatim-duplicated chunk/checkpoint protocol and the language→checklist map, and corrected the stale COSTS.md "~110K fixed" (it was counting scope-gated content as fixed).

Evidence-driven progressive disclosure

• Fixed a latent bug: FULL-AUDIT Step 4.4 said "read every file 001..131", which bulk-loaded all ~90K of known-vectors and nullified the gate. It now loads each vector only when its trigger fires.
• Added a "Load when (markers)" column to all 131 known-vectors — feature markers for feature-specific vectors, always (<phase>) for universal ones (private-key, secrets, supply-chain, access-control) so they're never skipped.
• Added an advisory relevance manifest to references/orchestration/pre-scan.md: 8 audit-scan prescan signals (cpi_sites:[], pdas:[], no token_2022 markers, …) → the corpus each defers → its re-open trigger.

Safety

• All gating is advisory: a provably-absent feature skip-defers to an evidence-backed [N/A — feature absent], reopened the instant a manual read surfaces it. Gate on provable absence only; the re-open trigger fires on the manual read (the prescan under-reports macros/trait-dispatch). No bug becomes unreachable.

Impact: −15% floor on every audit; on a no-feature Anchor vault, ~22K tokens of feature-specific vectors skip-defer (~57% of the crypto-phase vector read) on top of the ~30% audit-scan already removes — with zero coverage loss.

Credits: Frank Castle / safe-solana-builder and Trail of Bits / skills are now acknowledged in the README.

Full diff: v7.0.0...v7.1.0

v7.0.0 — Full audit lifecycle, executable PoCs + patches, Rust pre-scanner + memory

auditor-skill graduates from a prose+grep audit corpus into a full audit-firm platform.

Highlights

A full audit-firm lifecycle, two ways

• /auditor:audit-cycle — fully automated engagement (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) → professional client report.
• /auditor:audit-assist — the same pipeline, interactive, pausing at checkpoints for the calls only you can make.

Executable proofs, not just prose

• /auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability; /auditor:patch drafts a minimal fix and proves it reverts the exploit.
• Evidence tiers [PoC-REPRODUCED] … [PoC-PROSE] and fix tiers [FIX-VERIFIED] … [FIX-PROPOSED]. Prose is never dropped when a harness can't be built.

Token-efficient by construction (tools/auditor-tools/)

• audit-scan — a Rust pre-scanner that enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs.
• audit-mem — SQLite cross-audit memory: exact dedup, regression detection, false-positive suppression, warm re-audits.

Deeper corpus — 20 checklists / 1,346 items / 131 vectors

• Protocol methodologies 7 → 12: bridges, wallets/multisig/custody, Token-2022, NFT marketplaces, launchpads.
• FV escalation ladder + reusable invariant catalog; design-vs-implementation pass; Notes & Nitpicks tier; Impact×Likelihood downgrade levers.

New commands & agents

• Commands: /intake, /threat-model, /triage, /poc, /patch (15 total).
• Agents: threat-modeler, poc-engineer, patch-engineer (8 total).

Docs

• New docs/ folder with 8 usage guides. See docs/README.md.

Getting started

git submodule update --init --recursive      # Trail of Bits execution tooling
cd tools/auditor-tools && cargo build --release   # optional: pre-scanner + memory

The native corpus works fully without the submodule or the Rust tools — they are optional accelerators.

Full diff: 5d0e838...v7.0.0