Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,413 verification items · 136 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC
> /plugin marketplace add solanabr/auditor-skill> /plugin install auditor@auditor
Repo: solanabr/auditor-skill
What's inside
Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,413 verification items · 136 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC 2, OWASP Top 10:2025 Verify COSTS.md as a referecence - Running this audit can burn a lot of credits.
auditor-skill is a skill file (a structured prompt + checklists) that turns any LLM agent (Copilot, Cursor, Windsurf, Claude Code, Codex, etc.) into a professional-grade security auditor. It reads your code file by file, checks 1,413 items across 20 security domains, tests against 136 real-world attack vectors, and produces a structured report with severity scores.
It is not a SaaS product. It's a folder of markdown files you clone into your repo or give to an AI agent.
Adaptation required before use. This skill was originally developed for a specific Solana/Anchor DeFi project and then generalized. Before running it on your project you must update
discovery/file-map.mdwith your actual folder structure, file names, and state variable names. The questionnaire inQUESTIONS.mdis a blank template — fill it out (or run/auditor:intake) for your project before invoking the auditor. Everything else (checklists, known vectors, output rules) is fully portable as-is.
/auditor:audit-cycle runs the whole engagement autonomously (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) and hands back a professional client report. /auditor:audit-assist runs the same pipeline interactively, pausing at checkpoints for the calls only you can make./auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability, and /auditor:patch drafts a minimal fix and proves it reverts the exploit. Evidence is tiered ([PoC-REPRODUCED] … [PoC-PROSE]); prose is never dropped when a harness can't be built.audit-scan) enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs. A cross-audit memory store (audit-mem) gives exact dedup, regression detection, and false-positive suppression across runs.| Guide | What's inside |
|---|---|
| docs/getting-started.md | Install, submodule init, build the Rust tools, run your first audit |
| docs/audit-flows.md | The lifecycle and when to use each flow (/audit, /audit-cycle, /audit-assist, /re-audit) |
| docs/commands.md | Reference for all 15 commands |
| docs/agents.md | The 8-agent roster and how they chain |
| docs/power-tools.md | audit-scan, audit-mem, Trail of Bits, Surfpool, PoC/patch harnesses |
| docs/poc-and-patches.md | Executable exploit + fix-patch delivery |
| docs/output-and-rigor.md | Severity, the Rule 5b gate, scope-gated loading, report format |
| Language | Checklists | Items |
|---|---|---|
| Rust (Solana/Anchor) | 01-07 | 519 |
| Rust (off-chain services) | 20 | 21 |
| TypeScript / Node.js | 08-09 | 195 |
| React / Next.js | 08, 10 | 148 |
| Python | 14 | 82 |
| Go / Java / Ruby / PHP | 15 | 88 |
| AI / agent components | 19 | 33 |
| Always applied (any repo) | 11-13, 16-18 | 391 |
| Total | 20 | 1,413 |
/plugin marketplace add solanabr/auditor-skill
/plugin install auditor
Registers the marketplace and installs the auditor plugin — all 15 /auditor:* commands and 8 agents. Then initialize the Trail of Bits execution tooling once (optional but recommended):
git submodule update --init --recursive
Drops the skill into your project's .claude/skills/ and inits the tooling:
# from your project root — read it first (it's a security tool, after all):
git clone https://github.com/solanabr/auditor-skill.git
./auditor-skill/install.sh # → ./.claude/skills/auditor-skill
./auditor-skill/install.sh ~/.claude/skills/auditor-skill # or install globally
# one-liner (convenience):
curl -fsSL https://raw.githubusercontent.com/solanabr/auditor-skill/main/install.sh | bash
git clone https://github.com/solanabr/auditor-skill.git .claude/skills/auditor-skill
Claude Code auto-discovers skills under .claude/skills/; invoke by asking your agent to "audit this repo using the auditor-skill" (use Option 1 for the /auditor:* slash commands). For other agents (Cursor, Windsurf, Copilot, Codex), copy the folder anywhere the agent reads and point it at SKILL.md.
If you're building a service, send SKILL.md + OUTPUT-RULES.md + FULL-AUDIT.md as system context and the target repo files as user content to any LLM API.
auditor-skill vendors Trail of Bits as a git submodule (vendor/trailofbits) for real tool execution — SAST, fuzzing, coverage, mutation. Options 1 and 2 init it for you; to do it manually:
git submodule update --init --recursive
The native corpus works fully without it (it falls back to grep-based checks and notes where deeper tooling would run). With the submodule initialized, the auditor delegates to the vendored tools per references/orchestration/boundary-map.md. For the optional token-efficiency tools (audit-scan pre-scanner + audit-mem memory), build the Rust CLIs:
cd tools/auditor-tools && cargo build --release
auditor-skill does not bulk-read its whole corpus. It discovers the repo, declares an audit scope (OUTPUT-RULES.md Rule 0), and loads only the in-scope checklists and vectors on demand:
OUTPUT-RULES.md (always),checklists/*.md the detected languages require (e.g. 14-python-safety.md only if .py is present),known-vectors/*.md file only when its phase + language trigger reaches it,discovery/*.md and templates/*.md lazily, at the phase that uses them.The audit is complete when every in-scope item has an explicit verdict; out-of-scope items render [N/A — out of scope] from the gate.
Fill out the questionnaire: Copy QUESTIONS.md and answer all questions. This tells the auditor what checklists to apply, what severity calibration to use, and what compliance frameworks matter.
Review estimated costs: Check COSTS.md for token/dollar estimates based on your repo size and chosen model.
Choose your scope:
| Scope | What It Covers | Estimated Time (50K lines) |
|---|---|---|
| FULL | Everything — all 20 checklists + 136 vectors | 60-90 min |
| PROGRAM | Smart contract only (checklists 01-07) | 20-35 min |
| BACKEND | Backend API (checklists 08-09) | 15-25 min |
| FRONTEND | Frontend (checklists 08, 10) | 15-25 min |
| DEVOPS | Infra + supply chain (checklists 11-13) | 10-15 min |
| QUICK | Known vectors only (grep-based scan) | 5-10 min |
View @solanabr’s profileProduction-ready Claude Code configuration for full-stack Solana development. Combines best practices from multiple sources into an agent-optimized, token-efficient config you can install and adapt to your specific project.
@solanabrFAQ
auditor is a Claude Code plugin with 1 hand-picked skill for security work, indexed on Flowy. Install it with the command on its page. It includes auditor-skill. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it