Red Team Audit

Trust-boundary security audit — attacker mindset, attacks RUN against the local binary, every finding pinned as a regression guard.

This skill is the orchestrator. The contract — threat model, two attack vectors, method, finding format, rules, the cqs-tools block — lives in .claude/agents/unbiddable-auditor.md. Each spawned agent IS an unbiddable-auditor; its prompt carries only the category scope below. Do not re-embed the contract here (it drifts — the old inlined threat model went stale against SECURITY.md).

Arguments

• (none) — runs all 6 categories

Process

Setup

1. Read SECURITY.md — the auditor def re-derives the threat model from it per run, but read it yourself to sanity-check the category scopes against the current trust boundaries before dispatching.
2. Read prior triage (docs/audit-triage-v*.md) and current findings (docs/audit-findings.md) — pass the skip-list to each agent.
3. Enable audit mode: cqs audit-mode on --expires 4h (no -q on this subcommand).

Execution

4. Create team: boundary-probe.
5. Spawn one unbiddable-auditor (subagent_type: unbiddable-auditor, model opus) per category. Each prompt carries ONLY: the category's scope/key-question/targets/files below, the prior-findings skip-list, and "append findings to docs/audit-findings.md under ## Trust-Boundary." Everything else is in the def.
6. A category lead may fan out per-PoC verifiers (the def grants Agent).

Cleanup

7. Shutdown team after all agents complete.
8. Incorporate findings into main triage (docs/audit-triage.md).
9. Disable audit mode: cqs audit-mode off.

Categories

RT-INJ — Input Injection

Key question: can agent-controlled query/CLI/wire input escape its intended context? Targets: batch pipeline (| chaining), FTS5 construction (normalize_for_fts bypass on ANY path to MATCH), notes-text → TOML metacharacters, --ref names in SQL + fs paths (/, .., \0), shell-words split, CQS_PDF_SCRIPT script-path validation, --path globset ReDoS, --overlay-root path handling. Files: src/cli/batch/, src/note.rs + src/store/notes.rs, src/nl/fts.rs, src/search/, src/project.rs, src/convert/pdf.rs, src/cli/batch/handlers/.

RT-FS — Filesystem Boundary Violations

Key question: can any path reach a file outside the project root despite canonicalize+starts_with? Targets: completeness of the canonicalize+starts_with guard across ALL file-reading paths (incl. the worktree-overlay build's --overlay-root reindex), convert --output escape, reference-index path construction (../ escaping the refs dir), function-name-as-path-component, stale index entries serving wrong content. Files: src/cli/commands/io/read.rs, src/project.rs, src/convert/, src/store/mod.rs, src/worktree_overlay.rs, src/cli/batch/handlers/.

RT-RES — Robustness (security angle only)

Key question: can a crafted-but-valid input crash/hang/OOM the daemon as a denial channel? Cede generic malformed-input robustness to property-auditor and concurrency hangs to interleaving-auditor — keep the attacker-reachable resource-exhaustion angle. Targets: pipeline fan-out bomb, BFS depth bomb, token-budget extremes, query-length OOM (100KB → tokenizer), batch-session unbounded memory, watch event storm. Bare unwrap()/expect() only where attacker input reaches it. Files: src/cli/batch/, src/gather.rs, src/impact/, src/hnsw/, src/cli/watch/, src/embedder/.

RT-DATA — Silent Corruption (security angle only)

Key question: can attacker-influenced input leave the index inconsistent / serve wrong results without error? Cede concurrent-race corruption to interleaving-auditor and migration atomicity to legacy-state-auditor — keep the crafted-input-driven corruption. Targets: embedding-dimension confusion via a crafted model id, NaN/ordering injection breaking sort, batch cache staleness reachable by input, HNSW/SQLite desync via attacker-triggered delete/gc. Files: src/store/, src/hnsw/, src/note.rs, src/index.rs, src/embedder/.

RT-RELAY — Indirect Injection via Indexed Content (the agent-consumer axis)

Key question: can crafted content already in the corpus (a contributor's comment, an upstream dependency, a cqs ref add source, a developer note, an LLM summary) manipulate the consuming agent? This is SECURITY.md's longest section and the reason the trust-signal suite exists. Targets: indirect prompt-injection payloads surviving the relay without injection_flags firing or CQS_TRUST_DELIMITERS wrapping; forging a trust signal (trust_level: user-code on vendored/ref content, fake note_boost, mislabelled edge_kind); validate_summary bypass on the LLM-summary path; making suggest/dead recommend a harmful action (e.g. deleting live code) to an agent that acts on it; ranked-result poisoning that blends untrusted content as trusted. Files: src/vendored.rs, src/cli/json_envelope.rs, src/llm/validation.rs, src/store/notes.rs, src/search/ (RRF blending + rank_signals), src/cli/batch/handlers/search.rs, src/note.rs.

RT-EXFIL — Data Egress / Privacy (the dual oracle)

Key question: does data flow OUT beyond its PRIVACY.md-declared boundary — no adversary required, just an honest leak? The other categories check intrusion inward; this checks egress outward. The boundary held when nothing leaves beyond what was declared. Targets: the LLM-summary Batches API payload — does cqs index --llm-summaries send only the chunk to Anthropic, or more (the whole file, neighbouring context)?; tracing spans/events logging chunk content, full paths, or secrets that persist; cqs telemetry recording query text / content; error-message content leaking paths/content to a socket client (verify the redacted err-<id> discipline holds on EVERY error path, not just the overlay one); the embeddings/summary caches persisting content beyond intent. Files: src/llm/ (Batches client + exactly what it sends), src/cli/watch/ (daemon logging), the telemetry module, src/cli/json_envelope.rs (error redaction), src/store/ (cache contents).

Notes

• Model: opus, always — security is the documented Fable exception (the def states why). Do not switch to fable in a model sweep.
• New surfaces since the last sweep worth attention: the worktree overlay (--overlay-root, the overlay reindex reading worktree content) and the result-trust metadata (trust_level / injection_flags / rank_signals / edge_kind — forging these is RT-RELAY's core).