multi-pass-self-critiquelisted

# Multi-pass self-critique (meta-skill) This skill governs the protocol for high-precision audits where false positives are unacceptable. ## When to use - `/audit-strict` invocations - Pre-launch audits where the user has explicitly opted into slower, higher-precision review - Re-audits where prior tools have been noisy ## The protocol ### Pass A — Skill-driven, bottom-up Read the code line-by-line. Apply the vuln-skill library. Emit candidate findings with reasoning traces. ### Pass B — Exploit-driven, top-down Fresh context. Pretend you have no prior findings. Approach the contract as an attacker: "What would I steal here? What's the cheapest exploit?" Emit findings. ### Compare For each Pass-A finding, check Pass-B: - Did Pass B independently identify this issue (under any name)? - Does Pass B's exploit narrative match this issue's mechanism? For each Pass-B finding, check Pass-A: - Did the skill library flag this? ### Categorize | Pass A | Pass B | Result | |---|---|---| | ✓ | ✓ | **Consensus** — Confidence HIGH, keep | | ✓ | ✗ | Single-source A — Confidence MEDIUM, keep with note | | ✗ | ✓ | Single-source B — Confidence MEDIUM, keep with note | | ✗ | ✗ | Not reported | ### Synthesize Output the consensus findings as primary, single-source findings as secondary. Be explicit about which is which. ## Why this works - Each pass has different blind spots. Skill-based misses novel patterns; exploit-based misses subtle CWE patterns. - Their intersection is the