Bitter Security
Official@BitterSecurity · Korea, South
Autonomous Red Teaming Multi-Agent
Agent Skills by Bitter Security
Showing 31 vetted skills indexed across 1 GitHub repositories.
BitterSecuritypoc
Generates and validates Foundry PoC tests from smart contract attack scenario documents.
BitterSecurityvulnerability-base
Standardizes smart contract vulnerability findings with severity classification and structured report templates.
BitterSecuritydocs-analysis
Extract invariants, trust assumptions, and protocol type from smart contract documentation.
BitterSecuritycode-analysis
Maps smart contract structure, value flows, and protocol type during audit reconnaissance.
BitterSecurityaudit
Orchestrates multi-phase smart contract security audits from scope resolution to validated PoC reports.
BitterSecurityreport
Generates submission-ready smart contract audit reports from validated findings and PoC results.
BitterSecurityLending Protocol Patterns
Detects vulnerabilities in DeFi lending protocols covering liquidations, interest rates, and collateral.
BitterSecurityStaking Protocol Patterns
Detects vulnerabilities in Solidity staking and reward distribution contracts during security audits.
BitterSecurityERC4626 Vault Patterns
Detects inflation attacks, rounding errors, and donation vulnerabilities in ERC4626 tokenized vaults.
BitterSecuritystate-sync-analysis
Identifies state inconsistency windows and reentrancy attack vectors in Solidity smart contracts.
BitterSecurityinvariant-analysis
Extracts protocol invariants from Solidity code and explores violation paths.
BitterSecurityasset-flow-analysis
Maps asset storage, movement paths, and leakage points in Solidity smart contracts.
BitterSecuritytoken
Detects token-related vulnerabilities in Solidity smart contracts using pattern-based detection rules.
BitterSecurityreentrancy
Detects reentrancy vulnerabilities in Solidity smart contracts using CEI violation and callback patterns.
BitterSecuritylogic-error
Detects business logic vulnerabilities in Solidity smart contracts using calculation flow analysis.
BitterSecuritycross-chain
Detects cross-chain and bridge vulnerabilities in Solidity smart contracts using pattern-based checks.
BitterSecurityoracle
Detects oracle vulnerabilities in Solidity smart contracts including stale prices and manipulation patterns.
BitterSecurityflashloan
Detects flash loan attack patterns in Solidity smart contracts during security audits.
BitterSecurityeconomic-attack
Detects flash loan, oracle manipulation, and price manipulation vulnerabilities in Solidity smart contracts.
BitterSecurityaccess-control
Detects access control vulnerabilities in Solidity smart contracts using permission matrices and grep patterns.
BitterSecurityLSD Token Integration Patterns
Detects vulnerabilities in Liquid Staking Derivative token integrations during Solidity smart contract audits.
BitterSecurityLayerZero Integration Patterns
Audits LayerZero V2 OApp, OFT, and compose integrations for cross-chain security vulnerabilities.
BitterSecurityChainlink Integration Patterns
Audit Solidity smart contracts for Chainlink Price Feed, VRF, CCIP, and Automation vulnerabilities.
BitterSecurityinput-validation
Detects missing input validation vulnerabilities in Solidity smart contracts using pattern-based analysis.
Frequently Asked Questions About Bitter Security
FAQPage SchemaWhat tasks can I perform using Bitter Security's skills?▼
You can orchestrate end-to-end smart contract audits: documentation and code reconnaissance, vulnerability detection across reentrancy, oracle, flash loan, access control, and economic attack classes, Foundry PoC test generation per finding, and submission-ready report generation for Code4rena, Cantina, Sherlock, or Immunefi.
Who are these skills designed for?▼
They target smart contract security auditors, Web3 penetration testers, and competitive audit participants (Code4rena wardens, Sherlock researchers) who need structured vulnerability detection patterns, invariant analysis, and PoC validation for DeFi protocols including lending, staking, restaking, and ERC4626 vaults.
How does the audit execution flow work in practice?▼
Invoke the audit skill, which automatically runs all phases: scope definition, Phase 1 reconnaissance (docs-analysis and code-analysis), Phase 2 sub-auditor analysis with auto-loaded detection patterns, Phase 3 PoC generation into test/poc/{finding-id}.t.sol, and Phase 4 report generation from .vigilo/findings/.
What vulnerability classes and integrations are covered?▼
Coverage includes reentrancy, logic errors, oracle manipulation (Chainlink), flash loan and economic attacks, access control, upgradeability proxies (UUPS/Transparent/Beacon), DoS, randomness misuse, cross-chain messaging (LayerZero), token quirks (fee-on-transfer, rebasing, LSD tokens like stETH/wstETH), and restaking risks (EigenLayer).
What are the prerequisites and runtime dependencies?▼
Skills operate within a Foundry-based Solidity environment: PoC validation outputs Foundry test files (.t.sol) and findings are stored under .vigilo/findings/ and .vigilo/poc/. Most detection skills are auto-loaded by sub-auditor agents (user-invocable: false), while audit, poc, and report are directly invocable.