Security
Plugin
pashov-skills
AI-powered Solidity security skills — built by Pashov Audit Group. Supported AI Platforms:
Plugin Signal69/100Solid
maintained84
capable53
documented71
adopted64
Install
$ npx -y skills add pashov/skills --agent claude-code
Run the curl in your terminal, the rest in Claude Code.
Stats
1,052
Stars
192
Forks
Maintained
Maintenance
JavaScript
Language
MIT
License
1mo ago
Last commit
5mo ago
Created
Repo: pashov/skills
What's inside
Skills
2/fizz-convertConvert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes. Trigger on "fizz-convert", "convert properties", "implement properties from PROPERTIES.md", "convert/fizz-syncReconcile an existing Fizz harness with a changed source tree. Detects added/removed/changed contract functions, quarantines stale properties, regenerates drifted handler stubs, and refreshes the snapshot. Trigger on "fizz-sync", "resync fuzzing", "sync fuzz harness", "refresh
Agents
10global-property-implementer**Role**: Implement global properties into Properties.sol, wire ghost variables into Base.sol, and populate Snapshots.sol. These are checked by the fuzzer after every handler call.specific-property-implementer**Role**: Implement specific (per-handler) properties into Properties.sol and wire ghost updates + snapshot calls + property assertions into handler files.adversarial-profit-maximizer**Discovery approach**: Think like an attacker. What would maximize extracted value? What sequence breaks liveness? What edge conditions create exploitable state?conservation-auditor**Discovery approach**: For every aggregate/total variable, write a "sum of individual parts = tracked whole" property. This is the #1 bug-finding pattern in DeFi history.protocol-type-specialist**Discovery approach**: Auto-detect the protocol type from PROTOCOL_CONTEXT, then apply battle-tested property templates specific to that protocol category.roundtrip-rounding-analyst**Discovery approach**: For every paired operation and conversion function, verify that round-trips don't create value and rounding always favors the protocol.
Show all 10 agentsShow fewer
state-transition-mapper**Discovery approach**: Map the state machine, verify operation postconditions, check paired-operation symmetry, and ensure entity counts stay consistent.synthesizer**Role**: Merge outputs from 5 specialized invariant discovery agents into a consolidated property plan that maps to the Fizz harness architecture.protocol-analyzer**Role**: Perform manual protocol analysis when `x-ray` is unavailable, and produce a `protocol-understanding.md` file that downstream steps (4, 6, 7, 9) can read back as their protocol context.report-writer**Role**: Read the completed fuzzing suite outputs (coverage, corpus, campaign logs, properties, handlers) and produce the final `report.md`. This agent runs AFTER `forge build` and the `FoundryTester` sanity test have already passed — it is a pure synthesis/reporting step that
README
1Pashov Audit Group Skills
AI-powered Solidity security skills — built by Pashov Audit Group.
Supported AI Platforms:
Install, Run & Update Prompts
Install https://github.com/pashov/skills/ and run an x-ray on the codebase
Install https://github.com/pashov/skills/ and run solidity auditor with all different agents possible on the codebase
Install https://github.com/pashov/skills/ and run fizz on the codebase
run an x-ray on the codebase
run the solidity auditor with all the different agents possible on *specified files*
run fizz on the codebase
update skills to latest version
Skills
| Skill | Description |
|---|---|
| fizz | Generate a full Echidna/Medusa fuzz suite for any Foundry or Hardhat project |
| solidity-auditor | Solidity AI security audit - hundreds of Critical/High vulnerabilities found |
| x-ray | Pre-audit scan with threat model, invariants, entry points, and git analysis |
Contributing · Security · License · Contact
We welcome improvements and fixes. See CONTRIBUTING.md for the PR process.
Report vulnerabilities via Security Policy. This project follows the Contributor Covenant. MIT © contributors.
If you are looking to explore strategies for securing your project, reach out for a chat on Telegram @pashovkrum.
File tree
93pashov/skillsView on GitHub
.github/
ISSUE_TEMPLATE/
bug_report.md
feature_request.md
pull_request_template.md
workflows/
version-bump.yml
.gitignore
CLAUDE.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
fizz/
agents/
implementers/
global-property-implementer.md
specific-property-implementer.md
invariant-discovery/
adversarial-profit-maximizer.md
conservation-auditor.md
protocol-type-specialist.md
roundtrip-rounding-analyst.md
state-transition-mapper.md
synthesizer.md
protocol-analyzer.md
report-writer.md
evals/
evals.json
README.md
references/
handler-patterns.md
property-generation.md
selection-policy.md
setup-playbook.md
template-map.md
scripts/
ensure_foundry.sh
estimate_cost.js
extract_abis.js
fizz_sync.js
generate_handlers.js
generate_suite.js
lib/
log-viewer.js
run_echidna.js
run_medusa.js
select_functions.js
setup_fuzz_profile.sh
SKILL.md
skills/
fizz-convert/
SKILL.md
fizz-sync/
SKILL.md
templates/
Actor.sol
Base.sol
echidna.yaml
FoundryTester.sol
FuzzTester.sol
handlers/
Handlers.sol
medusa.json
Properties.sol
README.md
Snapshots.sol
utils/
Clamp.sol
DecimalPrinter.sol
Deployer.sol
EnumerableSet.sol
Hevm.sol
Logger.sol
Math.sol
MockERC20.sol
PropertiesAsserts.sol
StringUtils.sol
VERSION
LICENSE
README.md
SECURITY.md
solidity-auditor/
README.md
references/
hacking-agents/
access-control-agent.md
asymmetry-agent.md
boundary-agent.md
economic-security-agent.md
execution-trace-agent.md
first-principles-agent.md
flow-gap-agent.md
invariant-agent.md
math-precision-agent.md
numerical-gap-agent.md
periphery-agent.md
shared-rules.md
trust-gap-agent.md
judging.md
report-formatting.md
senior-auditor-sop.md
SKILL.md
VERSION
static/
fizz.gif
skill_pag.gif
x_ray.gif
x-ray/
README.md
references/
templates.md
threats.md
scripts/
analyze_git_security.py
enumerate.sh
generate_svg.py
SKILL.md
VERSIONFAQ
pashov-skills is a Claude Code plugin with 2 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes fizz-convert, fizz-sync. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is pashov-skills?
- AI-powered Solidity security skills — built by Pashov Audit Group. Supported AI Platforms:
- How do I install pashov-skills?
- Run these in Claude Code: npx -y skills add pashov/skills --agent claude-code. Then prompt normally.
- Does pashov-skills auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is pashov-skills free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.