crossval-harness

# Cross-validation harness · static + dynamic ## What this is The orchestration skill. It runs the two halves and correlates them so you get *proven* findings and root cause — not a wall of static maybes, and not a break with no explanation. ## Authorization & safety — read first Follow every rule in [`../README.md`](../README.md). Authorized target, disposable environment, no real credentials, harmless markers, no destruction, responsible disclosure. Otherwise **stop**. ## Procedure 1. **Static triage — where to look.** Read the agent's source and flag candidate paths: untrusted content reaching a dangerous sink, a signature-only guard, a missing check, an un-sandboxed exec. Map each candidate to a class (RT-1…RT-9). Tooling: `python3 scanner/static_scan.py --source /path/to/agent`. A candidate is **not** a finding. 2. **Dynamic confirmation — what's real.** For each candidate, run the matching skill (`rt1-prompt-injection`, `rt6-memory-poisoning`, `rt3-sandbox-escape`, `rt4-action-gating`) against the running agent. A finding is **confirmed** only when the exploit actually works. 3. **Correlate.** - **Confirmed:** trace the working exploit back to the exact code path → root cause, blast radius, and where to fix. - **Refuted:** a static candidate the dynamic pass couldn't exploit — kill it out loud. A false positive dies to a real attack, not a model vote. 4. **Grade & report.** Each finding carries both the code path and a working exploit, ...