auditor

auditor-skill — Open-Source AI Security Audit Skill

Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,446 verification items · 140 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC 2, OWASP Top 10:2025 Verify COSTS.md as a referecence - Running this audit can burn a lot of credits.

What Is This?

auditor-skill is a skill file (a structured prompt + checklists) that turns any LLM agent (Copilot, Cursor, Windsurf, Claude Code, Codex, etc.) into a professional-grade security auditor. It reads your code file by file, checks 1,446 items across 20 security domains, tests against 140 real-world attack vectors, and produces a structured report with severity scores.

It is not a SaaS product. It's a folder of markdown files you install for your AI agent — outside any repository you audit — or send to an LLM API.

Adaptation required before use. This skill was originally developed for a specific Solana/Anchor DeFi project and then generalized. discovery/file-map.md assumes that project's layout (programs/{name}/src/, apps/backend/src/, apps/web/src/). If yours differs, record where your code lives at intake instead: the in-scope paths under QUESTIONS.md Q39 ("Specific files/modules") and the exclusions under Q44, which /auditor:intake writes to audit_<n>/intake.md §1. An edited discovery/file-map.md in a shared or plugin install is lost on the next update. The questionnaire in QUESTIONS.md is a blank template — fill it out (or run /auditor:intake) for your project before invoking the auditor. Everything else (checklists, known vectors, output rules) is fully portable as-is.

What It Does (v7.6)

• Detection & response, post-incident (v7.6). /auditor:hunt works through transaction history, program logs and Geyser/indexer exports with a written hypothesis ledger; /auditor:respond starts from a signature, address or alert and establishes whether the attack landed, how far it reached, and why. Verdicts follow a single ladder; the response plan is for humans to carry out — the track acts on nothing. Ported Solana-native from Anthropic's defending-code-reference-harness.
• History-seeded threat models (v7.6). /auditor:threat-model --bootstrap starts the threat model from what already went wrong: removed or quietly added account guards, reverts and fix commits in the target's history, a fork's distance from its parent, prior audit reports, post-mortems and incident records. One read-only, hardened collector (scripts/threat-model/collect.sh) gathers it; non-interactive runs stay offline, and every goal cites its evidence.
• GitHub Actions trigger trust (v7.6). A CI playbook (references/vuln-classes/github-actions.md) for the shapes an outside account uses to reach a privileged job — comment-triggered commands without per-event author gating, expression and env-file injection, pull_request_target / workflow_run pwn requests with artifact and cache poisoning, and AI coding agents in CI — with KV-139/140, checklist 13 §13.13 (DEP-090..096), AI-034..035, read-only rules of engagement, and zsh-safe locator recipes backed by a fixture self-test.
• Operating safety & dependency-update review (v7.6). A new OUTPUT-RULES Rule 11 covers five things. Target code runs in the execution mode chosen at intake (isolated recommended; native allowed, with a report caveat). Outside-service use is disclosed. Untrusted .git/ checkouts are read without letting git run their config. Audit output never reaches git or a public CI log. Bundled scripts and tools run from the installation, never from a path in the audited repository. Checklist 11 §11.11 (SC-059..062) reviews what a dependency bump's published code actually changed, wired into /auditor:diff-audit and /auditor:re-audit. KV-077 and SC-005 now catch the hijacked @solana/web3.js 1.95.6 / 1.95.7 releases.
• Trail of Bits pin, reviewed and visible (v7.6). vendor/trailofbits moves from cfe5d7b (2026-06-30) to 82fe822 (2026-09-28) after a full delta review; upstream had since fixed a semgrep path that silently dropped two third-party rulesets and SARIF parsing that read CodeQL severities as zero errors. The pin is shown under Installation, fetched shallow, checked by CI against the gitlink, and moved by a monthly Dependabot PR that a maintainer reviews with scripts/tob-delta-review.sh; plugin users receive it with this release.
• Slot-as-clock coverage (v7.5). SIMD-0525 halved mainnet slot time to 200 ms (Oct 9, 2026) and Alpenglow (Oct 21, 2026) made Clock.unix_timestamp a leader-set value, so every timelock, vesting cliff, cooldown, oracle window, rate limit and interest constant denominated in slots now elapses in half the wall-clock time. KV-138 covers the class (the EVM learned it at the Merge with Compound's blocksPerYear; deployed lending programs still carrying SLOTS_PER_YEAR = 63,072,000, whether from an old-SDK build of SPL token-lending, the Save fork's literal or Kamino's legacy basis, now accrue 2.5x the configured APR), with SM-073..074, ECON-090..092, OPS-086..087, BE-132 and FV-073 as the per-domain checks.
• Vendored-program provenance (v7.4). Coverage for the newest exploited class on Solana — the Rain white-label card-contract exploit (Aug 2026, ~$1.1M across Avici, Tria and other tenants): KV-137 (deployed-program version drift, fleet blast radius, inherited admin surface), off-chain-signed authority-grant checks (AC-051..055 — the AddCollateralAdmin signature-bundle failure) and deployed-program provenance checks (SC-053..058) — the layer cargo audit / npm audit can't see, because the vulnerable artifact is your own deployed program.
• Transaction v1 readiness (v7.3). A vuln-class playbook for SIMD-0385 / SIMD-0296 (4,096-byte transactions, message-level compute config, no ComputeBudget instructions, no lookup tables): who breaks and how, per-role worksheets for RPC readers, indexers / Geyser consumers, fee sponsors / co-signers, introspecting programs, senders and wallets; KV-135 (sponsor cap bypass, disabled ComputeBudget gates) and KV-136 (reader wedge, zero-budget indexing); 23 checklist items across on-chain, TypeScript, backend, frontend, deployment, testing, monitoring and off-chain Rust.
• Token registries & permissioned tokens (v7.2). A registry / risk-signal methodology (canonical-asset resolution, primary-variant ranking, score farming — grounded in the open-sourced tokens.xyz stack), Token ACL (SRFC-37) gate-program coverage inside the Token-2022 playbook, and web-stack items for hosted auth, API-key issuance, external data providers, Next.js 16, Bun / Turborepo and GCP / Terraform.
• A full audit-firm lifecycle, two ways. /auditor:audit-cycle runs the whole engagement autonomously (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) and hands back a professional client report. /auditor:audit-assist runs the same pipeline interactively, pausing at checkpoints for the calls only you can make.
• Executable proofs, not just prose. For High/Critical findings, /auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability, and /auditor:patch drafts a minimal fix and proves it reverts the exploit. Evidence is tiered ([PoC-REPRODUCED] … [PoC-PROSE]); prose is never dropped when a harness can't be built.
• Token-efficient by construction. An optional Rust pre-scanner (audit-scan) enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs. A cross-audit memory store (audit-mem) gives exact dedup, regression detection, and false-positive suppression across runs.
• 17 commands, 9 specialized agents. Scoping, threat modeling, deep review, economic simulation, differential/PR audits, spec compliance, triage, fix-review — each a first-class command, plus a post-incident detection & response track (hunt + respond over transaction history). The automated audit flow chains eight purpose-built agents; a ninth, incident-responder, drives the post-incident track.
• Deep Solana coverage. 13 protocol methodologies (AMM/CLMM, lending, perps, oracles, stablecoins, liquid staking, governance, bridges, multisig/custody, Token-2022, NFT marketplaces, launchpads, token registries & risk signals), framework idioms (Anchor/Native/Pinocchio), and a reusable invariant catalog — loaded only when the code triggers them.
• Rigor gates against AI over-reporting. A validation gate (reachability + math/state-bounds + attacker-model) every high-severity finding must survive, Impact×Likelihood severity with principled downgrades, and a Notes & Nitpicks tier that keeps the findings table honest.
• Real tooling, vendored. Trail of Bits execution plugins (SAST, fuzzing, coverage, mutation) ship as a submodule; the native corpus works fully without them.

Documentation

Supported Languages & Frameworks

Installation

Install auditor-skill outside any repository you audit: the plugin (Option 1), or a user-level skill such as install.sh ~/.claude/skills/auditor-skill. A copy inside the audited repository resolves its scripts, tools and corpus from a tree that repository controls, and that repository's own .claude/, .mcp.json and CLAUDE.md are target-controlled too (OUTPUT-RULES.md Rule 11e).

Upgrading from 7.6.0 or earlier. Through 7.6.0, install.sh without a path installed into the current directory's .claude/skills/auditor-skill; it now installs to ~/.claude/skills/auditor-skill, and a run started next to such a copy notes it and leaves it alone. If your copy sits inside a repository, delete it (rm -rf .claude/skills/auditor-skill) and install a fresh copy outside: the plugin (Option 1), or Option 2. Never move or update a copy you find inside a repository: its git config may have come with that repository. Plugin users get 7.6.1 when they update the plugin.

Option 1: Claude Code plugin marketplace (recommended)