audit-changes
CommandAudit only the git diff vs main (or specified base). Optimized for PR review.
Generate a Foundry test suite — happy path + edge cases + adversarial tests — for a contract or function.
> /plugin marketplace add omermaksutii/RugProof> /plugin install rugproof@rugproof
description: Generate a Foundry test suite — happy path + edge cases + adversarial tests — for a contract or function. argument-hint: "<file-or-function>" allowed-tools: Read, Write, Bash, Agent, Skill, mcp__forge-runner__*
For `$ARGUMENTS` (a file, a contract, or a `Contract.function`), produce tests.
For each public/external function:
1. **Happy-path test** — typical input, expected output. 2. **Boundary tests** — zero, max, off-by-one. 3. **Revert tests** — every `require` / `revert` path. Use `vm.expectRevert("...")`. 4. **Access-control tests** — call from unauthorized actor, expect revert. 5. **Reentrancy tests** — for any function with external calls, attempt reentrancy from a malicious receiver. 6. **Adversarial tests** — based on findings from `/audit` if available.
For state machines, also generate sequence tests:
function test_DepositThenWithdraw() public { ... }
function test_DepositThenLiquidateThenWithdraw_reverts() public { ... }1. Read the contract. 2. Enumerate functions and their semantic behavior. 3. For each function, generate the test set as above. 4. Generate any helper contracts needed (mock tokens, malicious receivers). 5. Run `forge test` via the MCP. Iterate on failures until all pass.
test/generated/<Contract>.t.sol — main test file test/generated/mocks/<Mock>.sol — mock contracts test/generated/attackers/<Bad>.sol — adversarial contracts forge test result: 47 passing, 0 failing, 1.2s Coverage: 91% lines, 84% branches
Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy
Audit only the git diff vs main (or specified base). Optimized for PR review.
Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.
Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code…
Diff two Rugproof audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.
Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.
Audit a deployed contract on a live chain. Pulls verified source from the block explorer, optionally forks the chain for…
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…