vulnerability-base

Standardizes smart contract vulnerability findings with severity classification and structured report templates.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill vulnerability-base-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-base
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/vulnerability-base
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill vulnerability-base-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Smart contract audits often produce inconsistent findings across different auditors, making reports hard to compare, validate, and act on. This Skill enforces a single rigorous standard for documenting vulnerabilities so every finding includes code evidence, concrete attack steps, and consistent severity ratings. ## Core Features & Use Cases - Iron Laws Enforcement: Requires every finding to cite exact file paths, function names, line numbers, and annotated code snippets, rejecting vague or speculative claims. - Standardized Finding Template: Provides a Code4rena-style report format with root cause, impact, numbered attack scenario steps, and mitigation code. - Severity Classification & File Organization: Classifies findings as High, Medium, or Low and writes them to a structured .vigilo/findings/ directory with one file per finding. - Use Case: A sub-auditor agent analyzing a Solidity vault contract for reentrancy uses this Skill to write a properly formatted H-01 finding with an annotated code snippet and step-by-step attack scenario, which the main agent later converts into a Foundry PoC test. ## Quick Start Analyze the withdraw function in src/Vault.sol for reentrancy and write a formatted vulnerability finding to the findings directory.

Frequently Asked Questions about vulnerability-base

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a smart contract vulnerability finding?▼

Document the root cause, exact code location with file path and line numbers, an annotated Solidity snippet, impact assessment, and a numbered attack scenario with concrete function calls and parameters. Finish with a recommended mitigation showing the fixed code.

How are smart contract audit severities classified?▼

High severity covers direct fund loss or permanent denial of service, Medium covers conditional fund loss or temporary DoS, and Low covers minor issues and informational findings. Likelihood and impact are each justified separately before assigning the final severity.

Should audit findings include proof of concept code?▼

No, findings should contain detailed attack scenarios only, with numbered steps, specific function calls, and state changes. The main agent generates the actual Foundry PoC test code separately from the scenario.

Can I combine multiple vulnerabilities in one audit report file?▼

No, each finding must be its own file named with the pattern Severity-id-kebab-case-title, such as H-01-withdraw-reentrancy.md. Files are organized under severity folders like high, medium, and low within the findings directory.

Why should audit findings avoid dollar amounts in impact statements?▼

Dollar figures become outdated as TVL changes and can understate risk. Use qualitative descriptions like drains entire vault TVL or affects all user funds so the impact remains accurate regardless of market conditions.