Setting the file. One moment.
Self Critique Loop · Audit Integrity · github/awesome-copilot · Skills Docs
After completing the initial analysis, perform a mandatory second pass before delivering output.
Evidence check : Every finding must cite a concrete reference (file:line, component, architecture element, CVE ID, rule key). Remove any finding without supporting evidence.
Back to the top of the page
Coverage check : Verify that all categories, phases, or scan types relevant to the agent’s methodology were explicitly evaluated. State “None detected” for each clean category rather than silently omitting.
Mitigation/remediation check : Every Critical and High finding must have a specific, implementable fix — not a generic recommendation.Each agent adds domain checks to the universal list above:
STRIDE completeness : Did you evaluate all six STRIDE categories (S/T/R/I/D/E) for every trust boundary and data flow?Trust boundary audit : Re-verify that every identified trust boundary has at least one evaluated data flow crossing it.
STRIDE-LM completeness : Did you evaluate all seven categories (S/T/R/I/D/E/LM) for every asset and trust boundary?Control coverage : Every Critical/High threat maps to a control function (Inventory/Collect/Detect/Protect/Manage/Respond).Lateral movement audit : Re-trace all identified pivot paths. Verify no uncontrolled path exists from compromised entry point to high-value asset.
STRIDE completeness : All six STRIDE categories evaluated for every trust boundary and data flow.Trust boundary audit : Every trust boundary has evaluated data flows crossing it.
Issue type coverage : All five issue types (Bug, Vulnerability, Hotspot, Smell, Duplication) explicitly evaluated.Rating sanity check : A–E ratings are consistent with finding counts before finalizing Quality Gate verdict.
Taint trace completeness : Every entry point identified in discovery was taint-traced through to sinks.Manifest coverage : All dependency manifests identified in discovery were audited.
Phase coverage : All deliverable files generated and saved.Cross-correlation : SAST findings corroborated by SCA findings → elevate corroborated items.Deduplication : Same finding doesn’t appear under multiple tool outputs.Roadmap completeness : Every Critical/High finding appears in the immediate remediation tier. references/self-critique-loop.md