Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,346 verification items · 131 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC
Production-ready Claude Code configuration for full-stack Solana development. Combines best practices from multiple sources into an agent-optimized, token-efficient config you can install and adapt to your specific project.
@solanabrFAQ
auditor is a Claude Code plugin with 1 hand-picked skill for security work, indexed on Flowy. Install it with the command on its page. It includes auditor-skill. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
> /plugin marketplace add solanabr/auditor-skill> /plugin install auditor@auditor
Repo: solanabr/auditor-skill
Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,346 verification items · 131 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC 2, OWASP Top 10:2025 Verify COSTS.md as a referecence - Running this audit can burn a lot of credits.
auditor-skill is a skill file (a structured prompt + checklists) that turns any LLM agent (Copilot, Cursor, Windsurf, Claude Code, Codex, etc.) into a professional-grade security auditor. It reads your code file by file, checks 1,346 items across 20 security domains, tests against 131 real-world attack vectors, and produces a structured report with severity scores.
It is not a SaaS product. It's a folder of markdown files you clone into your repo or give to an AI agent.
Adaptation required before use. This skill was originally developed for a specific Solana/Anchor DeFi project and then generalized. Before running it on your project you must update
discovery/file-map.mdwith your actual folder structure, file names, and state variable names. The questionnaire inQUESTIONS.mdis a blank template — fill it out (or run/auditor:intake) for your project before invoking the auditor. Everything else (checklists, known vectors, output rules) is fully portable as-is.
/auditor:audit-cycle runs the whole engagement autonomously (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) and hands back a professional client report. /auditor:audit-assist runs the same pipeline interactively, pausing at checkpoints for the calls only you can make./auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability, and /auditor:patch drafts a minimal fix and proves it reverts the exploit. Evidence is tiered ([PoC-REPRODUCED] … [PoC-PROSE]); prose is never dropped when a harness can't be built.audit-scan) enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs. A cross-audit memory store (audit-mem) gives exact dedup, regression detection, and false-positive suppression across runs.| Guide | What's inside |
|---|---|
| docs/getting-started.md | Install, submodule init, build the Rust tools, run your first audit |
| docs/audit-flows.md | The lifecycle and when to use each flow (/audit, /audit-cycle, /audit-assist, /re-audit) |
| docs/commands.md | Reference for all 15 commands |
| docs/agents.md | The 8-agent roster and how they chain |
| docs/power-tools.md | audit-scan, audit-mem, Trail of Bits, Surfpool, PoC/patch harnesses |
| docs/poc-and-patches.md | Executable exploit + fix-patch delivery |
| docs/output-and-rigor.md | Severity, the Rule 5b gate, scope-gated loading, report format |
| Language | Checklists | Items |
|---|---|---|
| Rust (Solana/Anchor) | 01-07 | 517 |
| Rust (off-chain services) | 20 | 17 |
| TypeScript / Node.js | 08-09 | 163 |
| React / Next.js | 08, 10 | 136 |
| Python | 14 | 82 |
| Go / Java / Ruby / PHP | 15 | 88 |
| AI / agent components | 19 | 31 |
| Always applied (any repo) | 11-13, 16-18 | 372 |
| Total | 20 | 1,346 |
/plugin marketplace add solanabr/auditor-skill
/plugin install auditor
Registers the marketplace and installs the auditor plugin — all 15 /auditor:* commands and 8 agents. Then initialize the Trail of Bits execution tooling once (optional but recommended):
git submodule update --init --recursive
Drops the skill into your project's .claude/skills/ and inits the tooling:
# from your project root — read it first (it's a security tool, after all):
git clone https://github.com/solanabr/auditor-skill.git
./auditor-skill/install.sh # → ./.claude/skills/auditor-skill
./auditor-skill/install.sh ~/.claude/skills/auditor-skill # or install globally
# one-liner (convenience):
curl -fsSL https://raw.githubusercontent.com/solanabr/auditor-skill/main/install.sh | bash
git clone https://github.com/solanabr/auditor-skill.git .claude/skills/auditor-skill
Claude Code auto-discovers skills under .claude/skills/; invoke by asking your agent to "audit this repo using the auditor-skill" (use Option 1 for the /auditor:* slash commands). For other agents (Cursor, Windsurf, Copilot, Codex), copy the folder anywhere the agent reads and point it at SKILL.md.
If you're building a service, send SKILL.md + OUTPUT-RULES.md + FULL-AUDIT.md as system context and the target repo files as user content to any LLM API.
auditor-skill vendors Trail of Bits as a git submodule (vendor/trailofbits) for real tool execution — SAST, fuzzing, coverage, mutation. Options 1 and 2 init it for you; to do it manually:
git submodule update --init --recursive
The native corpus works fully without it (it falls back to grep-based checks and notes where deeper tooling would run). With the submodule initialized, the auditor delegates to the vendored tools per references/orchestration/boundary-map.md. For the optional token-efficiency tools (audit-scan pre-scanner + audit-mem memory), build the Rust CLIs:
cd tools/auditor-tools && cargo build --release
auditor-skill does not bulk-read its whole corpus. It discovers the repo, declares an audit scope (OUTPUT-RULES.md Rule 0), and loads only the in-scope checklists and vectors on demand:
OUTPUT-RULES.md (always),checklists/*.md the detected languages require (e.g. 14-python-safety.md only if .py is present),known-vectors/*.md file only when its phase + language trigger reaches it,discovery/*.md and templates/*.md lazily, at the phase that uses them.The audit is complete when every in-scope item has an explicit verdict; out-of-scope items render [N/A — out of scope] from the gate.
Fill out the questionnaire: Copy QUESTIONS.md and answer all questions. This tells the auditor what checklists to apply, what severity calibration to use, and what compliance frameworks matter.
Review estimated costs: Check COSTS.md for token/dollar estimates based on your repo size and chosen model.
Choose your scope:
| Scope | What It Covers | Estimated Time (50K lines) |
|---|---|---|
| FULL | Everything — all 20 checklists + 131 vectors | 60-90 min |
| PROGRAM | Smart contract only (checklists 01-07) | 20-35 min |
| BACKEND | Backend API (checklists 08-09) | 15-25 min |
| FRONTEND | Frontend (checklists 08, 10) | 15-25 min |
| DEVOPS | Infra + supply chain (checklists 11-13) | 10-15 min |
| QUICK | Known vectors only (grep-based scan) | 5-10 min |
auditor-skill/
├── README.md ← YOU ARE HERE
├── SKILL.md ← Orchestrator — the AI agent reads this first
├── OUTPUT-RULES.md ← Mandatory output format, severity scale
├── FULL-AUDIT.md ← Step-by-step execution plan for complete audits
├── QUESTIONS.md ← Pre-audit questionnaire (fill before running)
├── COSTS.md ← Estimated costs by model and repo size
│
├── known-vectors/ ← Individual attack vector files (for contributors)
│ ├── INDEX.md ← One-line index of all vectors
│ ├── 001-private-key-leak.md
│ ├── 002-flash-loan-price-manipulation.md
│ ├── ...
│ └── 100-insufficient-backup-disaster-recovery.md
│
├── checklists/ ← 20 micro-checklists (the core verification items)
│ ├── 01-program-account-validation.md (88 items)
│ ├── 02-program-access-control.md (50 items)
│ ├── 03-program-arithmetic-safety.md (63 items)
│ ├── 04-program-cpi-pda.md (70 items)
│ ├── 05-program-state-machine.md (72 items)
│ ├── 06-program-economic-logic.md (89 items)
│ ├── 07-program-opsec-governance.md (85 items)
│ ├── 08-typescript-safety.md (60 items)
│ ├── 09-backend-security.md (103 items)
│ ├── 10-frontend-security.md (76 items)
│ ├── 11-supply-chain.md (46 items)
│ ├── 12-secrets-opsec.md (53 items)
│ ├── 13-deployment-infrastructure.md (79 items)
│ ├── 14-python-safety.md (82 items)
│ ├── 15-general-language-safety.md (88 items)
│ ├── 16-formal-verification-testing.md (71 items)
│ ├── 17-logging-monitoring-incident-response.md (63 items)
│ ├── 18-privacy-compliance-change-management.md (60 items)
│ ├── 19-ai-agent-security.md (31 items) — AI agents on Solana
│ └── 20-rust-offchain-services.md (17 items) — Off-chain Rust (geyser/indexers/keepers)
│
├── discovery/ ← File patterns and search commands
│ ├── file-map.md ← Maps checklists → target file patterns
│ └── grep-commands.md ← All grep/terminal commands by category
│
├── references/ ← Progressive-disclosure deep coverage (loaded on trigger)
│ ├── methodologies/ ← 12 protocol playbooks (amm-clmm, lending, perps, oracles,
│ │ stablecoin, liquid-staking, governance, bridges,
│ │ wallets-multisig-custody, token-2022, nft-marketplaces, launchpads)
│ ├── framework-idioms/ ← Anchor / Native / Pinocchio validation-order footguns
│ ├── vuln-classes/ ← zk-and-compression
│ ├── invariant-catalog.md ← Reusable harness-ready invariant menus per protocol class
│ ├── false-positives.md ← Over-reporting triage rules
│ ├── audit-lifecycle/ ← methodology + firm-coverage (how firms actually work)
│ └── orchestration/ ← boundary-map (Trail of Bits) · pre-scan · poc-harness
│
├── commands/ ← 15 slash-commands (/auditor:<name>)
│ ├── audit · quick-scan · deep-review · diff-audit · spec-audit · economic-sim · audit-report
│ ├── audit-cycle · audit-assist · re-audit ← lifecycle flows
│ ├── intake · threat-model · triage ← perimeter
│ └── poc · patch ← executable PoC + fix patches
│
├── agents/ ← 8 specialized subagents
│ ├── context-builder · threat-modeler · vuln-hunter · economic-analyst
│ └── peer-reviewer · audit-reporter · poc-engineer · patch-engineer
│
├── tools/auditor-tools/ ← Rust CLIs (cargo build --release)
│ ├── audit-scan ← deterministic pre-scan → JSON risky-surface map (~$0)
│ └── audit-mem ← SQLite cross-audit memory (dedup · regression · FP-suppression)
│
├── templates/ ← Output + deliverable templates
│ ├── report-template.md ← Internal item-by-item verdict report
│ ├── audit-report.md ← Client-facing findings report (no deploy guarantee)
│ ├── context-worksheet.md · instruction-worksheet.md · intake.md · threat-model.md
│ ├── poc/ ← exploit-harness crate skeleton + shared-test-utils
│ └── patch/ ← patch + VERIFICATION templates
│
├── docs/ ← Usage guides (start at docs/README.md)
├── scripts/ ← report-to-pdf.sh + the no-attribution commit hook
├── AGENTS.md ← Agent-orchestration overview
└── vendor/trailofbits/ ← Trail of Bits execution plugins (git submodule)
Beyond one-shot /audit, two flows run a full audit-company lifecycle end-to-end:
/auditor:audit-cycle — a fully automated audit-agent team (scope → context reconstruction → tool-assisted pass → parallel manual review with leaf-level false-positive gating → independent peer reconciliation → synthesis) that produces a professional client report at audit_<n>/REPORT.md. Optional PDF (needs pandoc):
scripts/report-to-pdf.sh audit_1/REPORT.md # writes REPORT.pdf if pandoc is installed; MD is always the deliverable
/auditor:audit-assist — an AI-assisted, human-in-the-loop flow: it pauses at checkpoints to surface findings and ask the questions only you can answer (business context, trust model, severity calls), iterating until the audit document converges./auditor:re-audit — fix-review: diffs against a prior report (FIXED / STILL-OPEN / REGRESSED) and sweeps for un-patched siblings of each fixed bug.Every intermediary step is also addressable on its own: /auditor:intake (persisted scoping), /auditor:threat-model (asset/actor/trust-boundary artifact), /auditor:triage (dedup + false-positive calibration), and /auditor:poc / /auditor:patch (executable exploit + verified fix). Full command reference: docs/commands.md.
The client report follows professional firm convention — executive summary, commit-pinned scope, findings with PoC/reachability, a code-maturity assessment, disclaimers. Like real firms, it does not issue a "safe to deploy" guarantee. Method + firm coverage: references/audit-lifecycle/.
The audit produces a structured markdown report with:
[PASS], [FAIL-N], [PARTIAL], or [N/A]For High/Critical findings, an optional audit_<n>/poc/ (runnable exploits that assert the bug) and audit_<n>/patches/ (minimal fixes proven to revert the exploit) accompany the report — see docs/poc-and-patches.md.
See OUTPUT-RULES.md for the complete specification.
@workspace Audit the entire repository using the auditor-skill
Read .claude/skills/auditor-skill/SKILL.md then audit this repository following the FULL-AUDIT.md execution plan
Read the auditor-skill files in .claude/skills/auditor-skill/ and perform a full security audit of this repository
# Send SKILL.md + OUTPUT-RULES.md + FULL-AUDIT.md as system prompt
# Send target files as user messages (chunked)
# Collect structured output
known-vectors/NNN-short-name.md with the next available number---
id: NNN
title: "Your Attack Name"
severity: 7
category: crypto|backend|frontend|devops
---
### NNN — Your Attack Name
**Severity: 7** | **Real: Example Incident ($X, Year)**
Brief description of the attack.
#### Verification Procedure
**Step 1: Description**
\```
grep command or check to perform
\```
- ✅ PASS: What passing looks like
- ❌ FAIL: What failing looks like
**Step 2: ...**
(continue with 3-12 steps)
**Overall verdict:**
- ✅: Full mitigation criteria
- ⚠️: Partial mitigation criteria
- ❌: Vulnerability criteria
checklists/If model pricing changes, update COSTS.md with new rates.
This auditor was designed by comparing methodology from:
| Standard | Domain | What We Took |
|---|---|---|
| CertiK | Crypto audit | On-chain vulnerability taxonomy, formal verification approach |
| EY / SOC 2 | Enterprise IT audit | Control objectives, evidence requirements |
| OWASP Top 10:2025 | Web security | Attack categories, severity calibration |
| NIST SP 800-53 | Government security | Control framework structure |
| COBIT 2019 | IT governance | Process maturity model |
| GDPR / MiCA / DORA | EU regulation | Compliance checklist items |
MIT — use it, fork it, improve it, sell services built on it. Attribution appreciated but not required.
Q: Does this replace a professional audit? A: It covers more items than most paid audits (1,346 plus 131 known-vector checks vs typical 50-200), but an AI auditor cannot do everything a human can (social engineering assessment, business logic review requiring domain expertise, legal compliance opinions). Use this as a first pass, then hire humans for what it flags.
Q: Which AI model should I use? A: See COSTS.md. For maximum depth, use Opus 4 or o3. For best value, use Sonnet 4 or GPT-4.1. For CI/CD integration (fast, cheap), use Haiku or o4-mini.
Q: How long does an audit take? A: Depends on repo size and model. A 50K-line repo takes 60-90 minutes with Opus 4. See COSTS.md for full estimates.
Q: Can I use this in CI/CD? A: Yes — run the QUICK scope (known vectors grep scan) on every PR, and FULL scope on release branches.
Q: Can I use this for non-Solana projects? A: Yes — checklists 08-18 are language-agnostic or cover Python/Go/Java/Ruby/PHP. Checklists 01-07 are Solana-specific.
auditor-skill stands on the shoulders of two open-source security projects — credited in full in ATTRIBUTION.md:
vendor/trailofbits and orchestrated for real execution; methodology patterns re-implemented natively are credited by reference.All third-party methodology is used by reference — no third-party text is copied into this repository.
.claude-plugin/
marketplace.json
plugin.json
.gitignore
.gitmodules
agents/
AGENTS.md
audit-reporter.md
context-builder.md
economic-analyst.md
patch-engineer.md
peer-reviewer.md
poc-engineer.md
threat-modeler.md
vuln-hunter.md
assets/
banner.png
ATTRIBUTION.md
checklists/
01-program-account-validation.md
02-program-access-control.md
03-program-arithmetic-safety.md
04-program-cpi-pda.md
05-program-state-machine.md
06-program-economic-logic.md
07-program-opsec-governance.md
08-typescript-safety.md
09-backend-security.md
10-frontend-security.md
11-supply-chain.md
12-secrets-opsec.md
13-deployment-infrastructure.md
14-python-safety.md
15-general-language-safety.md
16-formal-verification-testing.md
17-logging-monitoring-incident-response.md
18-privacy-compliance-change-management.md
19-ai-agent-security.md
20-rust-offchain-services.md
commands/
audit-assist.md
audit-cycle.md
audit-report.md
audit.md
deep-review.md
diff-audit.md
economic-sim.md
intake.md
patch.md
poc.md
quick-scan.md
re-audit.md
spec-audit.md
threat-model.md
triage.md
COSTS.md
discovery/
file-map.md
grep-commands.md
docs/
agents.md
audit-flows.md
commands.md
getting-started.md
output-and-rigor.md
poc-and-patches.md
power-tools.md
README.md
FULL-AUDIT.md
install.sh
known-vectors/
001-private-key-leak.md
002-flash-loan-price-manipulation.md
003-reentrancy-cpi.md
004-missing-access-control.md
005-oracle-manipulation.md
006-first-depositor-share-inflation.md
007-mev-sandwich-attack.md
008-rug-pull-admin-backdoor.md
009-unchecked-cpi-target.md
010-pda-confusion-type-cosplay.md
011-integer-overflow-underflow.md
012-arithmetic-rounding-exploit.md
013-missing-signer-check.md
014-account-reinitialization.md
015-unchecked-account-owner.md
016-token-account-mismatch.md
017-vault-donation-attack.md
018-fee-on-transfer-token-exploit.md
019-freeze-authority-griefing.md
020-program-upgrade-hijack.md
021-governance-attack-vote-buying.md
022-bridge-exploit-fake-proof.md
023-token-2022-transfer-hook-attack.md
024-stale-missing-account-close.md
025-compute-budget-exhaustion-dos.md
026-pda-seed-collision.md
027-missing-discriminator-check.md
028-front-running-transaction.md
029-withdraw-before-update-race.md
030-infinite-mint-uncapped-supply.md
031-nosql-injection-mongodb.md
032-sql-injection.md
033-mass-assignment-vibe-coding.md
034-baas-auth-bypass-supabase-firebase.md
035-jwt-algorithm-confusion.md
036-ssrf-server-side-request-forgery.md
037-cors-misconfiguration.md
038-idor-insecure-direct-object-reference.md
039-rate-limiting-bypass.md
040-command-injection.md
041-path-traversal-lfi.md
042-xml-external-entity-xxe.md
043-prototype-pollution.md
044-server-side-template-injection.md
045-webhook-forgery.md
046-graphql-introspection-depth-attack.md
047-websocket-hijacking.md
048-redos-regex-denial-of-service.md
049-http-response-splitting.md
050-session-fixation.md
051-account-enumeration.md
052-unbounded-request-body-dos.md
053-missing-wallet-signature-verification.md
054-default-credentials-in-production.md
055-exposed-debug-admin-endpoints.md
056-xss-via-svg-image-injection.md
057-stored-xss-user-content.md
058-dom-based-xss.md
059-clickjacking.md
060-oauth-state-forgery-csrf-via-oauth.md
061-sensitive-data-in-url-parameters.md
062-client-side-auth-bypass.md
063-postmessage-origin-bypass.md
064-localstorage-token-theft.md
065-clipboard-hijacking-crypto-address.md
066-css-exfiltration.md
067-wallet-blind-signing-exploit.md
068-subresource-integrity-bypass.md
069-third-party-script-compromise.md
070-open-redirect.md
071-missing-csp-content-security-policy.md
072-api-key-exposure-in-client-bundle.md
073-dangling-dns-subdomain-takeover.md
074-insecure-external-link-no-rel.md
075-console-data-leak-in-production.md
076-dependency-confusion-substitution-attack.md
077-malicious-npm-package-typosquatting.md
078-secrets-in-git-history.md
079-env-file-committed-to-repo.md
080-ci-cd-pipeline-injection.md
081-insecure-docker-configuration.md
082-exposed-admin-debug-endpoints-in-production.md
083-missing-rate-limiting-on-critical-endpoints.md
084-prototype-pollution.md
085-server-side-request-forgery-ssrf.md
086-insecure-deserialization.md
087-insufficient-logging-monitoring.md
088-insecure-cors-configuration.md
089-unpatched-server-dependencies.md
090-missing-https-tls-misconfiguration.md
091-upgrade-authority-not-secured.md
092-dns-hijacking-domain-takeover.md
093-improper-error-handling-error-leak.md
094-missing-input-length-limits.md
095-insecure-randomness.md
096-missing-security-headers.md
097-stale-leaked-development-credentials.md
098-broken-access-control-on-api-endpoints.md
099-insecure-websocket-connections.md
100-insufficient-backup-disaster-recovery.md
101-sysvar-spoofing-instructions-introspection.md
102-precompile-signature-verification-bypass.md
103-address-lookup-table-manipulation.md
104-non-canonical-bump-pda-derivation-confusion.md
105-token-2022-extension-abuse.md
106-account-revival-zombie-after-close.md
107-fake-non-canonical-associated-token-account.md
108-token-decimals-cross-mint-amount-confusion.md
109-pinocchio-ptoken-missing-manual-validation.md
110-agent-wallet-key-custody-spend-caps.md
111-bpf-stack-frame-overflow-dos.md
112-in-memory-secret-non-zeroization.md
113-autonomous-agent-blind-signing.md
114-mcp-tool-poisoning.md
115-onchain-data-prompt-injection.md
116-ai-coding-agent-ci-deploy-key.md
117-agent-delegation-scope-creep.md
118-stake-account-authority-hijack.md
119-durable-nonce-pre-signed-governance-abuse.md
120-onchain-randomness-predictability.md
121-cnft-account-compression-merkle-proof.md
122-inner-instruction-event-log-spoofing.md
123-lamport-donation-account-bricking.md
124-wallet-cleartext-key-export.md
125-bonding-curve-launchpad-graduation-abuse.md
126-session-token-as-custody.md
127-ata-account-precreation-dos.md
128-onchain-floating-point-math.md
129-keeper-request-execute-frontrunning.md
130-clmm-tick-boundary-liquidity-math.md
131-write-lock-account-contention-dos.md
INDEX.md
LICENSE
OUTPUT-RULES.md
QUESTIONS.md
README.md
references/
audit-lifecycle/
firm-coverage.md
methodology.md
false-positives.md
framework-idioms/
anchor.md
build-and-tooling.md
native.md
pinocchio.md
invariant-catalog.md
methodologies/
amm-clmm.md
bridges.md
governance.md
launchpads.md
lending.md
liquid-staking.md
nft-marketplaces.md
oracles.md
perps.md
stablecoin.md
token-2022.md
wallets-multisig-custody.md
orchestration/
boundary-map.md
poc-harness.md
pre-scan.md
report-format.md
vuln-classes/
zk-and-compression.md
scripts/
hooks/
commit-msg
report-to-pdf.sh
SKILL.md
templates/
audit-report.md
context-worksheet.md
instruction-worksheet.md
intake.md
patch/
patch.md
VERIFICATION.md
poc/
Cargo.toml
README.md
run.sh
shared-test-utils/
Cargo.toml
src/
lib.rs
src/
fixed.rs
lib.rs
vulnerable.rs
tests/
exploit.rs
fixed_blocked.rs
report-template.md
threat-model.md
tools/
auditor-tools/
Cargo.lock
Cargo.toml
README.md
src/
bin/
audit-mem.rs
audit-scan.rs
lib.rs
mem.rs
scan.rs
tests/
mem_roundtrip.rs
scan_fixture.rs
vendor/© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic