audit-changes
CommandAudit only the git diff vs main (or specified base). Optimized for PR review.
Gas profile — find expensive operations and suggest optimizations with before/after numbers.
> /plugin marketplace add omermaksutii/RugProof> /plugin install rugproof@rugproof
description: Gas profile — find expensive operations and suggest optimizations with before/after numbers. argument-hint: "<file-or-contract>" allowed-tools: Read, Write, Bash, Agent, Skill, mcp__forge-runner__*
mcp__forge-runner__gas_report()
Returns per-function gas costs from the existing test suite.
Dispatch `gas-optimizer` subagent. It looks for:
For each opportunity, produce a diff. Estimate gas saved using a benchmark test.
If `--apply`, apply the patches and re-run gas report. Show before/after.
Gas profile for src/Vault.sol:
Function Avg Min Max Median
deposit 147K 142K 158K 144K
withdraw 203K 189K 225K 198K ← top spender
rebalance 412K 398K 431K 410K ← top spender
Optimization opportunities:
1. withdraw():
- Cache `users[msg.sender]` in memory (called 4× in fn body)
- Estimated savings: 8K gas/call
2. rebalance():
- Replace `string memory reason` with custom errors
- Estimated savings: 12K gas/call
3. Storage layout:
- Pack `bool paused` + `uint8 feeRate` + `address admin` into one slot
- Saves one SSTORE per init: 20K gasApply with `--apply`. Re-runs the gas report and shows deltas.
Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy
Audit only the git diff vs main (or specified base). Optimized for PR review.
Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.
Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code…
Diff two Rugproof audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.
Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.
Audit a deployed contract on a live chain. Pulls verified source from the block explorer, optionally forks the chain for…
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…