code-analysis

Maps smart contract structure, value flows, and protocol type during audit reconnaissance.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill code-analysis-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-analysis
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/code-analysis
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill code-analysis-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security auditors need to quickly understand an unfamiliar smart contract codebase before hunting for vulnerabilities. This Skill provides a structured reconnaissance methodology that maps contract structure, traces value flows, and classifies protocol type, producing a standardized findings document. ## Core Features & Use Cases - Contract Structure Mapping: Discovers source files across Solidity, Rust, Cairo, and Move projects, extracts inheritance trees, dependencies, and entry points while skipping tests and mocks. - Flow Tracing: Identifies entry flows (deposit, stake, swap), exit flows (withdraw, claim), and privileged admin operations to understand how value moves through the protocol. - Protocol Classification: Classifies the codebase as AMM/DEX, Lending, Vault, Governance, Staking, or Bridge based on code pattern indicators. - Use Case: During Phase 1 of a smart contract audit, run this reconnaissance to generate .vigilo/recon/code-findings.md listing contracts, flows, asset storage patterns, and notable patterns like delegatecall or .call{value:} for deeper Phase 2 analysis. ## Quick Start Analyze this Solidity project and produce a code reconnaissance report covering contract structure, value flows, and protocol classification.

Frequently Asked Questions about code-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform reconnaissance on a smart contract codebase before an audit?▼

Start by discovering source files with glob patterns for the target language, skipping tests and mocks. Then map contract structure and inheritance, trace entry and exit value flows, and classify the protocol type. Write results to a structured findings document for later audit phases.

How to identify the protocol type of a smart contract project?▼

Match code patterns against known indicators: AMMs show reserves and swap functions, lending protocols show borrow and liquidate functions, vaults show shares and totalAssets, and bridges show lock and mint patterns. The classification determines which specialist audit approach applies.

Does this reconnaissance methodology support Rust or Cairo contracts?▼

Yes, it covers Solidity, Rust, Cairo, and Move. Each language has defined file discovery patterns and framework markers, such as Anchor.toml for Rust, Scarb.toml for Cairo, and Move.toml for Move projects.

What files should be skipped during smart contract code analysis?▼

Skip test directories, files ending in .t.sol or .test.sol, mock contracts, node_modules, lib dependency folders, and generated or compiled artifacts. These do not represent the protocol's production attack surface.

What is the difference between reconnaissance and vulnerability hunting in audits?▼

Reconnaissance only maps what the code does: structure, flows, and notable pattern locations. It deliberately avoids analysis or exploit reasoning, which is handled in a later audit phase that consumes the reconnaissance findings document.