solidity-auditor
Professional-grade Solidity smart contract security auditor. Performs comprehensive audits or targeted reviews (security vulnerabilities, gas optimization, storage optimization, code architecture, DeFi protocol analysis). Use this skill when users request smart contract audits, security reviews, vulnerability assessments, gas/storage optimization analysis, code quality reviews, or when analyzing Solidity code for any security or quality concerns. Supports all Solidity versions with version-specific vulnerability detection. Based on OWASP Smart Contract Top 10 (2025) and real-world exploit patterns.
- Installs
- 192
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/schwepps/skills --skill solidity-auditor- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads solidity-auditor automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Solidity Smart Contract Auditor
A professional-grade smart contract audit skill covering security vulnerabilities, gas optimization, storage patterns, and code architecture. Adapted to Solidity version specifics.
Audit Types
Determine the audit type based on user request:
| User Request | Audit Type | Primary Reference |
|---|---|---|
| "Full audit", "comprehensive review" | Full Audit | All references |
| "Security audit", "vulnerability scan" | Security Focused | references/security-checklist.md |
| "Gas optimization", "reduce gas costs" | Gas Optimization | references/gas-optimization.md |
| "Storage optimization", "storage patterns" | Storage Optimization | references/storage-optimization.md |
| "Code review", "architecture review" | Architecture Review | references/architecture-review.md |
| "DeFi audit", "protocol review" | DeFi Protocol | Security + Architecture references |
Core Audit Workflow
Phase 1: Preparation
-
Identify Solidity Version: Check pragma statement. Read
references/version-specific.mdfor version-specific considerations:- Pre-0.8.0: Check for SafeMath usage, arithmetic vulnerabilities
- 0.8.0+: Review
uncheckedblocks, check custom errors usage
-
Understand Scope:
- List all contracts, interfaces, libraries
- Identify external dependencies (OpenZeppelin, etc.)
- Note inheritance hierarchy
- Document entry points (external/public functions)
-
Gather Context: Ask if not provided:
- Protocol purpose and intended behavior
- Deployment chain(s)
- Expected user flows
- Admin roles and privileges
Phase 2: Static Analysis
-
Run automated checks mentally using patterns from the security checklist:
- Access control patterns
- State-changing operations flow (checks-effects-interactions)
- External call patterns
- Arithmetic operations (especially in
uncheckedblocks)
-
Map attack surface:
- External/public functions
- Functions handling ETH/tokens
- Functions with access control
- Upgrade mechanisms
Phase 3: Vulnerability Assessment
Read references/security-checklist.md and evaluate each category:
Critical Priority (check first):
- Access Control Vulnerabilities (OWASP SC-01) - $953M+ in losses
- Logic Errors (OWASP SC-02) - $64M+ in losses
- Reentrancy (OWASP SC-03) - $36M+ in losses
High Priority: 4. Flash Loan Attack Vectors (OWASP SC-04) 5. Input Validation (OWASP SC-05) 6. Oracle Manipulation (OWASP SC-06) 7. Unchecked External Calls (OWASP SC-07)
Medium Priority: 8. Integer Overflow/Underflow (version-dependent) 9. Denial of Service vectors 10. Front-running vulnerabilities
Phase 4: Optimization Analysis (if requested)
For gas optimization: Read references/gas-optimization.md
For storage optimization: Read references/storage-optimization.md
Phase 5: Report Generation
Use the template in references/report-template.md to structure findings.
Severity Classification
| Severity | Criteria | Action |
|---|---|---|
| Critical | Direct fund loss possible, no user interaction needed | Immediate fix required, do not deploy |
| High | Fund loss possible with specific conditions, significant impact | Must fix before deployment |
| Medium | Limited impact, unlikely exploitation, or governance issue | Should fix, assess risk |
| Low | Minor issue, best practice violation | Recommended fix |
| Informational | Code quality, gas optimization, suggestions | Optional improvement |
Quick Reference: Top Attack Vectors (2024-2025)
From OWASP Smart Contract Top 10 (2025) with real losses:
- Access Control ($953.2M): Missing/incorrect modifiers, exposed admin functions
- Logic Errors ($63.8M): Flawed business logic, incorrect calculations
- Reentrancy ($35.7M): State updates after external calls
- Flash Loans ($33.8M): Price manipulation, governance attacks
- Input Validation ($14.6M): Missing bounds checks, unchecked parameters
- Oracle Manipulation ($8.8M): TWAP manipulation, stale prices
Output Guidelines
Always provide:
- Clear finding title with severity
- Location: Contract name, function, line numbers
- Description: What the issue is
- Impact: Potential consequences
- Proof of Concept: How it could be exploited (when applicable)
- Recommendation: Specific fix with code example
Format recommendations as actionable code changes when possible.
Reference Files
Load these as needed based on audit type:
references/security-checklist.md- Complete vulnerability checklist with detection patternsreferences/gas-optimization.md- Gas optimization techniques and patternsreferences/storage-optimization.md- Storage layout and optimizationreferences/architecture-review.md- Code architecture best practicesreferences/version-specific.md- Solidity version considerationsreferences/report-template.md- Professional audit report template
FAQ
What does the solidity-auditor skill do?
Professional-grade Solidity smart contract security auditor. Performs comprehensive audits or targeted reviews (security vulnerabilities, gas optimization, storage optimization, code architecture, DeFi protocol analysis). Use this skill when users request smart contract audits, security reviews, vulnerability assessments, gas/storage optimization analysis, code quality reviews, or when analyzing Solidity code for any security or quality concerns. Supports all Solidity versions with version-specific vulnerability detection. Based on OWASP Smart Contract Top 10 (2025) and real-world exploit patterns.
How do I install solidity-auditor?
Run npx skills add https://github.com/schwepps/skills --skill solidity-auditor in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/solidity-auditor/ (personal) or .claude/skills/solidity-auditor/ (project).
Which AI agents can use solidity-auditor?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is solidity-auditor safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains solidity-auditor?
It is published by schwepps in schwepps/skills. It has 192 recorded installs.
More from schwepps/skills
suno-music-creator
schwepps/skills
Professional music creation with Suno AI V5 and Suno Studio. Use this skill when users want to create songs, playlists, corporate anthems, jingles, workout music, ambient soundscapes, or any AI-generated music. Triggers on requests mentioning Suno, music creation, playlist generation, song composition, or specific music projects like "create a track", "make a playlist", "compose music for", "corporate anthem", "workout mix", or any music production task.
linkedin-personal-branding
schwepps/skills
Comprehensive LinkedIn personal branding analysis, profile optimization, and visibility improvement skill using Claude for Chrome browser tools. Use when users request LinkedIn profile analysis, personal branding audit, profile optimization recommendations, LinkedIn visibility improvement, headline optimization, About section review, content strategy guidance, engagement analysis, or Social Selling Index improvement. Works with Claude for Chrome to analyze profile photos, banners, headlines, About sections, experience, skills, recommendations, featured content, activity/posts, and network engagement directly from the user's browser.
geo-aeo-optimization
schwepps/skills
Open the skill to read its SKILL.md instructions.
linkedin-roast
schwepps/skills
Open the skill to read its SKILL.md instructions.
seo-technical-audit
schwepps/skills
Open the skill to read its SKILL.md instructions.
seo-content-audit
schwepps/skills
Comprehensive on-page SEO and content quality audit covering title tags, meta descriptions, header structure, keyword optimization, E-E-A-T signals, readability, and content scoring. Use when evaluating content for SEO performance, reviewing articles before publication, or creating content improvement recommendations.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.