audit-context-building

Performs line-by-line code analysis to build architectural context before security auditing.

Updated May 17, 2026
One-click install
npx skills add https://github.com/irrit-us/agent_misc --skill audit-context-building-irrit-us
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-context-building
Source: https://github.com/irrit-us/agent_misc/tree/main/skills/audit-context-building
Command: npx skills add https://github.com/irrit-us/agent_misc --skill audit-context-building-irrit-us

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security audits and architecture reviews often fail because reviewers jump to vulnerability hunting with only gist-level understanding, leading to hallucinated findings, missed edge cases, and lost context. This Skill enforces a disciplined, ultra-granular context-building phase so every conclusion is grounded in actual code evidence. ## Core Features & Use Cases - Line-by-Line Micro-Analysis: Applies First Principles, 5 Whys, and 5 Hows to every function block, documenting purpose, inputs, outputs, invariants, and assumptions with line-number citations. - Cross-Function Flow Tracing: Follows internal and external calls as one continuous execution flow, treating unknown external contracts as adversarial and propagating invariants across boundaries. - Structured Quality Gates: Ships with an output requirements spec, a completeness checklist, and a full worked example of a DEX swap analysis to enforce minimum depth thresholds. - Use Case: Before auditing a Solidity DeFi protocol, activate this Skill to systematically map actors, state variables, trust boundaries, and end-to-end workflows, producing a stable mental model that the later vulnerability-hunting phase can rely on. ## Quick Start Use the audit-context-building skill to perform a line-by-line micro-analysis of the contracts in this repository before we start looking for vulnerabilities.

Frequently Asked Questions about audit-context-building

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build deep code context before a security audit?▼

Perform line-by-line micro-analysis of each function, documenting purpose, inputs, outputs, invariants, and assumptions with line-number citations. Apply First Principles, 5 Whys, and 5 Hows per block, then reconstruct global state, workflows, and trust boundaries before hunting for bugs.

What is the difference between context building and vulnerability hunting?▼

Context building produces deep understanding of code behavior, invariants, and data flows without drawing security conclusions. Vulnerability hunting happens afterward and uses that stable context to identify, classify, and rate actual bugs.

How should external contract calls be analyzed during a code audit?▼

If the external contract's code exists in the codebase, jump into it and continue block-by-block analysis as one continuous flow. If the code is unavailable, model the call as adversarial, considering reverts, malicious return values, unexpected state changes, and reentrancy.

When should I not use ultra-granular line-by-line analysis?▼

Avoid it when you need vulnerability findings, fix recommendations, exploit reasoning, or severity ratings, since this approach is pure context building only. It is also excessive for quick triage or high-level code familiarization.

How do I prevent hallucinations during AI-assisted code review?▼

Require every claim to cite specific line numbers, replace vague statements like "probably" with explicit "unclear; need to check X" markers, and update earlier assumptions explicitly when contradicted. Periodic anchor summaries of invariants and actor roles keep the analysis coherent.