docs-analysis

Extract invariants, trust assumptions, and protocol type from smart contract documentation.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill docs-analysis-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: docs-analysis
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/docs-analysis
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill docs-analysis-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Auditing a smart contract protocol without understanding its intended behavior leads to missed vulnerabilities. This Skill provides a structured methodology for analyzing protocol documentation during the reconnaissance phase of a security audit, turning scattered READMEs, whitepapers, and security docs into actionable audit intelligence. ## Core Features & Use Cases - Four Essential Questions Framework: Systematically answers where the money is, who can move it, what invariants must hold, and what trust assumptions exist. - Protocol Type Classification: Maps documentation patterns to protocol types (AMM, Lending, Vault, Governance, Staking, Bridge) with priority attack vectors for each. - Invariant Extraction: Captures explicit invariants from docs and infers implicit ones, marking inferred items with [INFERRED] for downstream audit phases. - Use Case: During Phase 1 reconnaissance of a DeFi vault audit, the speculator agent uses this methodology to produce .vigilo/recon/docs-findings.md, giving specialist auditors a documented trust model and invariant checklist before they read any code. ## Quick Start Analyze this protocol's documentation and produce a docs-findings report covering assets, privileged functions, invariants, and trust assumptions.

Frequently Asked Questions about docs-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze smart contract documentation before a security audit?▼

Start by locating README, docs folders, SECURITY.md, and whitepapers, then answer four questions: where assets are held, who can move them, what invariants must hold, and who is trusted. Record findings in a structured report for later audit phases.

What invariants should I look for in DeFi protocol documentation?▼

Look for explicit invariants signaled by words like must, always, and never, plus mathematical relationships. For implicit invariants, apply protocol-type patterns such as reserveX * reserveY >= k for AMMs or userDebt <= collateral * LTV for lending.

How do I classify a protocol type from its documentation?▼

Match documentation keywords to protocol patterns: swap and liquidity indicate an AMM, borrow and liquidate indicate lending, deposit and shares indicate a vault, and lock and mint indicate a bridge. Each type maps to priority attack vectors.

What should I do when protocol documentation is minimal or missing?▼

Rate the documentation quality as Poor or Minimal, flag all missing critical information, infer what is possible while marking items as [INFERRED], and note the increased audit risk. Never assume which conflicting version is correct.

Does this methodology analyze smart contract source code?▼

No, this is documentation reconnaissance only and explicitly skips code files like .sol and .rs. The goal is understanding intended protocol behavior before code analysis begins in later audit phases.