Make advisory prompt conditional via use_advisory global

Author: anticomputer

scripts/audit/run_audit.sh

@@ -33,8 +33,8 @@ if [ "$USE_ADVISORY" = true ]; then
   python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.fetch_security_advisories -g repo="$1"
 fi
 
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.classify_application_local -g repo="$1"
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.audit_issue_local_iter -g repo="$1"
+python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.classify_application_local -g repo="$1" -g use_advisory="$USE_ADVISORY"
+python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.audit_issue_local_iter -g repo="$1" -g use_advisory="$USE_ADVISORY"
 
 set +e
 

src/seclab_taskflows/taskflows/audit/audit_issue_local_iter.yaml

@@ -8,6 +8,7 @@ model_config: seclab_taskflows.configs.model_config
 
 globals:
   repo:
+  use_advisory:
 # Taskflow to audit some potential issues.
 taskflow:
   - task:
@@ -41,7 +42,9 @@ taskflow:
 
         {{ result.issue_notes }}
 
+        {% if globals.use_advisory == 'true' %}
         {% include 'seclab_taskflows.prompts.audit.known_security_advisories' %}
+        {% endif %}
 
         {% include 'seclab_taskflows.prompts.audit.audit_issue' %}
       toolboxes:

src/seclab_taskflows/taskflows/audit/classify_application_local.yaml

@@ -8,6 +8,7 @@ model_config: seclab_taskflows.configs.model_config
 
 globals:
   repo:
+  use_advisory:
 # Taskflow to analyze the general contextual information of a project and classify the different applications within it
 taskflow:
   - task:
@@ -38,7 +39,9 @@ taskflow:
         can you tell me what type of application this repo is and what kind of security boundary it has.
         Based on this, determine whether the component is likely to have security problems.
 
+        {% if globals.use_advisory == 'true' %}
         {% include 'seclab_taskflows.prompts.audit.known_security_advisories' %}
+        {% endif %}
 
         Identify the most likely security problems in the component. Your task is not to carry out a full audit, but to
         identify the main risk in the component so that further analysis can be carried out.