auditor

auditor-skill — Open-Source AI Security Audit Skill

Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,346 verification items · 131 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC 2, OWASP Top 10:2025 Verify COSTS.md as a referecence - Running this audit can burn a lot of credits.

---

What Is This?

auditor-skill is a skill file (a structured prompt + checklists) that turns any LLM agent (Copilot, Cursor, Windsurf, Claude Code, Codex, etc.) into a professional-grade security auditor. It reads your code file by file, checks 1,346 items across 20 security domains, tests against 131 real-world attack vectors, and produces a structured report with severity scores.

It is not a SaaS product. It's a folder of markdown files you clone into your repo or give to an AI agent.

Adaptation required before use. This skill was originally developed for a specific Solana/Anchor DeFi project and then generalized. Before running it on your project you must update discovery/file-map.md with your actual folder structure, file names, and state variable names. The questionnaire in QUESTIONS.md is a blank template — fill it out (or run /auditor:intake) for your project before invoking the auditor. Everything else (checklists, known vectors, output rules) is fully portable as-is.

---

What It Does (v7.0)

• A full audit-firm lifecycle, two ways. /auditor:audit-cycle runs the whole engagement autonomously (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) and hands back a professional client report. /auditor:audit-assist runs the same pipeline interactively, pausing at checkpoints for the calls only you can make.
• Executable proofs, not just prose. For High/Critical findings, /auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability, and /auditor:patch drafts a minimal fix and proves it reverts the exploit. Evidence is tiered ([PoC-REPRODUCED] … [PoC-PROSE]); prose is never dropped when a harness can't be built.
• Token-efficient by construction. An optional Rust pre-scanner (audit-scan) enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs. A cross-audit memory store (audit-mem) gives exact dedup, regression detection, and false-positive suppression across runs.
• 15 commands, 8 specialized agents. Scoping, threat modeling, deep review, economic simulation, differential/PR audits, spec compliance, triage, fix-review — each a first-class command; the automated flow chains eight purpose-built agents.
• Deep Solana coverage. 12 protocol methodologies (AMM/CLMM, lending, perps, oracles, stablecoins, liquid staking, governance, bridges, multisig/custody, Token-2022, NFT marketplaces, launchpads), framework idioms (Anchor/Native/Pinocchio), and a reusable invariant catalog — loaded only when the code triggers them.
• Rigor gates against AI over-reporting. A validation gate (reachability + math/state-bounds + attacker-model) every high-severity finding must survive, Impact×Likelihood severity with principled downgrades, and a Notes & Nitpicks tier that keeps the findings table honest.
• Real tooling, vendored. Trail of Bits execution plugins (SAST, fuzzing, coverage, mutation) ship as a submodule; the native corpus works fully without them.

Documentation

Guide	What's inside
docs/getting-started.md	Install, submodule init, build the Rust tools, run your first audit
docs/audit-flows.md	The lifecycle and when to use each flow (/audit, /audit-cycle, /audit-assist, /re-audit)
docs/commands.md	Reference for all 15 commands
docs/agents.md	The 8-agent roster and how they chain
docs/power-tools.md	audit-scan, audit-mem, Trail of Bits, Surfpool, PoC/patch harnesses
docs/poc-and-patches.md	Executable exploit + fix-patch delivery
docs/output-and-rigor.md	Severity, the Rule 5b gate, scope-gated loading, report format

---

Supported Languages & Frameworks