Cairo audit skill
AI-assisted security auditing for Cairo smart contracts. An open-source Agent Skill for Claude Code.
npx -y skills add alebeta06/cairo-audit-skillAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Assist with security audits of Cairo smart contracts on Starknet. Use when reviewing Cairo/Starknet contracts for vulnerabilities, running audits, threat modeling, or writing snforge security tests. Triggers on "audit", "Cairo", "Starknet", "vulnerability", "security review".
SKILL.md
3.6 KB, as published. Nobody here has run it
Cairo Audit Skill
Status: 🚧 Skeleton — the workflow and reference files below are placeholders to be filled in future sessions.
What This Skill Does
Guides AI-assisted security audits of Cairo smart contracts on Starknet. It structures the review
process, surfaces known vulnerability patterns, and helps write snforge security tests. It
does not replace a human auditor — it accelerates and organizes their work.
When to Use
- Reviewing a Cairo/Starknet contract before merge or deployment.
- Threat modeling a Starknet protocol (accounts, upgrades, cross-domain messaging).
- Writing or reviewing
snforgesecurity / fuzz tests.
When NOT to Use
- Writing new feature code (this skill is read-and-review oriented).
- Deployment-only operations.
- Non-Cairo ecosystems (use a Solidity- or Rust-specific skill instead).
Reference Files
| Context | Path |
|---|---|
| Vulnerability patterns (by category) | patterns/ (TODO) |
| Vulnerable vs. secure contract examples | examples/ (TODO) |
| snforge security test templates | tests-templates/ (TODO) |
| Extended documentation | docs/ (TODO) |
Audit Workflow
<!-- 🇪🇸 NOTA: Estos pasos son un PLACEHOLDER. La metodología real (qué buscar en cada paso y qué comandos correr) se documentará en próximas sesiones. -->- Initial read — understand the architecture before hunting for bugs. (TODO)
- Threat model — who attacks, what they want, their capabilities. (TODO)
- Static analysis — run Caracal. (TODO)
- Manual line-by-line review — where the real bugs live. (TODO)
- Property testing & fuzzing —
snforge. (TODO) - Report — severity + recommendations. (TODO)
Principles
- Assume every external call is hostile.
- Assume any balance, price, or cross-domain message can be manipulated in the current block.
- Hunt for implicit invariants the developer assumed but never validated.
- Never declare code "secure" — declare "no issues found under this threat model".