auditor-skill

Solid

**AUDIT SKILL** — Comprehensive on-chain Solana program auditor and full-stack security review for ANY programming language. USE FOR: auditing Solana/Anchor programs, reviewing smart contract security, checking for vulnerabilities (missing signers, unchecked accounts, arithmetic overflow, CPI attacks, PDA confusion, type cosplay, reinitialization, flash loan exploits, MEV, governance backdoors, timelock bypass), auditing TypeScript/Python/Go/Java/Ruby/PHP/any language, backend/frontend code review, supply chain safety, operational security (multisig, upgrade authority, deploy process), formal verification and testing quality, logging/monitoring/incident response, data privacy/GDPR/SOC2 compliance, change management, penetration testing methodology, AI/ML security, generating audit reports, running full repository audits. Severity 1-10 scale, 20 micro-checklist domains with 1413 individual verification items, plus 136 known attack vectors, chunked file-by-file execution, item-by-item verdicts. Benchmarked agai

Data & Documents 53 stars 13 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 84/100

Stars 20%

Recency 20%

100

Frontmatter 20%

Documentation 15%

100

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

# auditor-skill — Multi-Language Security Audit Skill > **Version:** 7.3 > **Items:** 1,413 across 20 checklists (+ 136 known vectors) > **Languages:** Rust, TypeScript, Python, Go, Java, Ruby, PHP, + any via general checklist > **Severity:** 1–10 numeric scale > **Benchmarked against:** CertiK (crypto audit), EY/SOC 2/COBIT (traditional IT audit), OWASP Top 10:2025 > **Designed for:** Autonomous AI auditor agent or human-guided review --- ## SCOPE-GATED LOADING — Load What The Repo Needs auditor-skill does not read its whole corpus up front. It discovers the repo, declares a scope, loads only what that scope requires, then guarantees a verdict for every in-scope item. **Step 1 — Discover (cheap, always).** Enumerate file extensions and markers (`Anchor.toml`, `Cargo.toml`, `package.json`, `*.py`, `.github/`). No checklists or vectors loaded yet. **Step 2 — Declare scope.** Map detected languages (+ any `--scope`) to the in-scope checklist set: | Detected | Load checklists | |----------|-----------------| | `.rs` / `Anchor.toml` | 01–07 (+ 20 for `.rs` outside `programs/`) | | `.ts` / `.tsx` | 08 (+ 09 if backend, + 10 if web) | | `.py` | 14 | | `.go` / `.java` / `.rb` / `.php` / other | 15 | | AI / agent components (`.mcp.json`, agent SDKs) | 19 | | **any repo** | 11, 12, 13, 16, 17, 18 | Checklists outside this set are **never read** — a Rust-only repo never loads 14 or the TS/web vectors. **Step 3 — Load on demand.** Load an in-scope checklist when its p...

Details

Author: solanabr
Repository: solanabr/auditor-skill
Created: 4 months ago
Last Updated: 2 days ago
Language: Rust
License: MIT

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

ln-22-codebase-auditor

Audits cross-cutting code health across security, delivery, maintainability, dependencies, diagnosability, concurrency, and lifecycle. Use when no specialist audit is primary.

558 Updated 6 days ago

levnikolaevich

AI & Automation Listed

sc-audit

Security auditor for smart contracts - identifies vulnerabilities, logic flaws, reentrancy, access control issues, MEV/economic attacks, and oracle manipulation. Use when auditing Solidity, Vyper, or Rust/Anchor contracts, reviewing PRs for security issues, checking for exploits, or analyzing DeFi protocols. Triggers on "audit", "security review", "vulnerability", "exploit", "reentrancy", "access control", "MEV", "frontrunning".

0 Updated today

OneDro1d

Code & Development Listed

auditsmith

Use when auditing, reviewing, or assessing an application's codebase — including narrower phrasings like 'review my code', 'is this secure', 'is this production ready', 'why is this slow', 'check my error handling', 'is my LLM integration safe', 'find issues in this repo', or 'what am I missing before launch'. Covers ten areas — UX behavior, code quality, UI, security, LLM/AI usage, performance, testing, dependencies, observability, API contracts. Detects auth/authz gaps, IDOR, injection, secrets, SSRF, prompt injection, race conditions, missing error handling, empty states, N+1 queries, bundle bloat, memory leaks, flaky tests, CVEs, idempotency gaps, missing logging/alerting. Contexts — pre-launch, handover, client delivery, code review, refactor planning. Outputs findings with file:line evidence, severity ranking, and CI/lint rules to prevent regression. Stacks — React, TypeScript, Node, Python, Go, Cloudflare Workers.

1 Updated 1 months ago

opefyre