audit-prep-assistant

Prepares codebases for security audits using Trail of Bits' checklist methodology.

Updated Apr 3, 2026
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-prep-assistant-ayoub-ouederni
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-prep-assistant
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/audit-prep-assistant
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-prep-assistant-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security audits fail or stall when codebases arrive unprepared: unresolved static analysis findings, low test coverage, dead code, missing build instructions, and absent documentation force auditors to waste time on issues that could have been fixed beforehand. ## Core Features & Use Cases - Review Goal Setting: Documents security objectives, areas of concern, worst-case scenarios, and questions for auditors. - Static Analysis & Cleanup: Runs Slither for Solidity, dylint for Rust, golangci-lint for Go, plus CodeQL and Semgrep, then triages findings and removes dead code. - Documentation Generation: Produces flowcharts, sequence diagrams, user stories, actor/privilege maps, glossaries, and NatSpec function documentation. - Use Case: Two weeks before a Trail of Bits audit of a Solidity DeFi protocol, use this Skill to run Slither, measure Forge test coverage, freeze an audit branch, and generate a complete prep package with architecture diagrams and build instructions. ## Quick Start Help me prepare my Solidity codebase for an upcoming security audit by running static analysis and generating the audit prep checklist.

Frequently Asked Questions about audit-prep-assistant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prepare my codebase for a security audit?▼

Follow a four-step process: set review goals documenting your concerns, run static analysis tools and fix easy issues, ensure code accessibility with build instructions and a frozen commit, and generate documentation like flowcharts and user stories. Start 1-2 weeks before the audit date.

What static analysis tools should I run before a smart contract audit?▼

For Solidity, run Slither with the --exclude-dependencies flag. Rust projects use dylint, Go projects use golangci-lint, and Go, Rust, or C++ codebases can also run CodeQL and Semgrep checks. Triage all findings and document accepted risks.

Does audit preparation work for Rust and Go projects?▼

Yes, the process supports Solidity, Rust, Go, and C++ codebases. Each language has designated static analysis tooling, and the documentation, test coverage, and code freeze steps apply regardless of platform.

What documentation do security auditors need before a review?▼

Auditors need flowcharts and sequence diagrams of primary workflows, user stories, on-chain and off-chain assumptions, an actors and privileges map, function-level documentation with invariants and parameter ranges, a glossary of domain terms, and verified build instructions.

When should I freeze the code version before an audit?▼

Freeze the version well before the audit, not at the last minute. Identify the commit hash, create a dedicated branch, tag the release, and lock dependencies so auditors review a stable, reproducible snapshot of the code.