audit

Orchestrates multi-phase smart contract security audits from scope resolution to validated PoC reports.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill audit-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/audit
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill audit-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Manually auditing Solidity smart contracts for vulnerabilities is slow and error-prone, requiring coordinated reconnaissance, protocol-specific analysis, and proof-of-concept validation before findings can be submitted to platforms like Code4rena. ## Core Features & Use Cases - Automated Audit Pipeline: Runs five phases end-to-end without user intervention: scope resolution, parallel reconnaissance, protocol-aware auditor selection, PoC validation, and report generation. - Protocol-Specific Auditor Selection: Detects protocol type (AMM, Lending, Vault, Governance, Bridge, Staking, NFT) from recon output and deploys up to three matching specialist auditors such as reentrancy-auditor or oracle-auditor. - PoC Validation with Foundry: Generates Forge test files for each High/Medium finding and only marks findings VALIDATED when tests pass and assertions prove the claimed impact. - Use Case: Point the skill at a Code4rena contest repository and it resolves the scope, maps the codebase, finds vulnerabilities like donation attacks or stale price checks, validates them with executable PoCs, and produces submission-ready reports. ## Quick Start Ask the agent to audit this repository for smart contract vulnerabilities and generate validated findings with submission-ready reports.

Frequently Asked Questions about audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an automated smart contract security audit?▼

Invoke the audit skill on a Solidity repository and it automatically executes all phases: scope resolution, reconnaissance, parallel sub-auditor analysis, PoC validation, and report generation. No manual intervention is needed between phases.

How are auditors selected for different protocol types?▼

The skill detects protocol type from recon output using function signatures like swap, borrow, or convertToShares. It then maps the type to three specialist auditors, for example flashloan-auditor, oracle-auditor, and reentrancy-auditor for AMM/DEX protocols.

Does the audit skill validate findings with proof of concept code?▼

Yes, every High and Medium finding gets a Foundry test file generated in test/poc/. A finding is only marked VALIDATED when the forge test passes and its assertions prove the claimed impact, not merely when the test passes.

What happens if no scope.txt file exists in the project?▼

The skill falls back to extracting scope from README.md scope sections, then to auto-detection via glob patterns like src/**/*.sol excluding test and mock directories. Auto-detected scope triggers a warning asking the user to verify.

Can sub-auditors write their own PoC exploit code?▼

No, sub-auditors write attack scenarios only. The main agent generates PoC code from those scenarios because it holds project-wide context needed for correct test setup and validation.