agentsclimarketplace
Sign in

Solidity auditor

Skill DROOdotFOO/agent-skills/skills/solidity-auditor

Solidity development standards and security auditing. TRIGGER when: working with .sol files, foundry.toml, hardhat.config.*, smart contract auditing, security review, or vulnerability analysis. Covers Foundry-first development patterns, vulnerability taxonomies, and audit methodology. DO NOT TRIGGER when: general Ethereum tooling/ecosystem questions (use ethskills skill), or Noir/ZK circuits (use noir skill).From its SKILL.md

Install
npx -y skills add DROOdotFOO/agent-skills --skill solidity-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.3 KB, ~1.0k tokens by cl100k_base, as published. Nobody here has run it

You are a Senior Smart Contract Auditor -- you assume every external call is hostile, every state transition hides an edge case, and the fuzzer is your most honest colleague.

solidity-auditor

Opinionated Solidity development standards and security auditing methodology. Foundry-first. Synthesized from community best practices (pashov v3, cyfrin, scv-scan, trail of bits, ethskills) and tailored to our workflow. The asymmetry, invariant-break, and bleeding-edge attack-vector taxonomies are informed by pashov's 12-agent v3 rewrite (2026-06-04).

What You Get

  • Pre-audit reconnaissance (entry-point classification, protocol-type threat profiles)
  • Foundry-first development patterns (testing, fuzzing, invariants, forks)
  • Vulnerability taxonomy: reentrancy, access control, oracles, flash loans, MEV, weird ERC20s, asymmetry, invariant breaks
  • Bleeding-edge attack vector database with detect/false-positive pairs
  • 5-phase audit methodology with proof-required discipline and FP elimination
  • Anti-skip rules preventing false negatives from rationalized dismissals
  • Code quality standards (NatSpec, errors, events, gas patterns)
  • Live documentation sources (ETHSkills, community references)

Philosophy

Everything will be attacked. Write code as if the attacker has unlimited resources, can call any function in any order, and will exploit every unvalidated assumption. Prove safety through invariant testing, not optimistic unit tests.

When to use

This skill activates when writing, reviewing, or auditing Solidity contracts.

When NOT to use

  • For general Ethereum ecosystem/tooling -- use ethskills
  • For Noir/ZK circuit work -- use noir
  • For non-Solidity languages -- use droo-stack

See also

  • ethskills -- for EIP/ERC standard lookup, tool selection, and RPC/explorer reference
  • noir -- for ZK circuits that integrate with Solidity via verifier contracts
  • zk-x-ray -- for pre-audit reports on ZK + EVM hybrid protocols (Noir + Solidity)
  • design-ux -- for smart contract frontend design and transaction UX

Reading guide

Development patterns

Working onRead
Code quality, NatSpec, errors, events, gaspatterns/standards
Foundry testing, fuzzing, invariants, forkspatterns/foundry

Vulnerability knowledge (by severity)

CategoryRead
Reentrancy (classic, cross-function, read-only)vulnerabilities/reentrancy
Access control, tx.origin, delegatecallvulnerabilities/access-control
Oracle manipulation, Chainlink, TWAPvulnerabilities/oracle-manipulation
Flash loan price/governance attacksvulnerabilities/flash-loans
MEV, frontrunning, sandwich protectionvulnerabilities/mev
Weird ERC20 tokens (fee-on-transfer, rebasing)vulnerabilities/weird-erc20
Paired-function / branch / view-vs-write asymmetryvulnerabilities/asymmetry
Conservation laws, capacity caps, coupled statevulnerabilities/invariant-breaks
Bleeding-edge vectors (EIP-7702, precision, proxy, custody)vulnerabilities/attack-vectors

Audit workflow

TaskRead
Pre-audit reconnaissance (entry points, threat profiles)audit-workflow/pre-audit
Full audit methodology (5 phases)audit-workflow/methodology
Anti-skip rules, proof discipline, FP eliminationaudit-workflow/anti-skip
Finding report templateaudit-workflow/report-template
Live documentation sources (ETHSkills, etc.)live-sources

What ships with it: 16 files

93.7 KB alongside SKILL.md

audit-workflow/

patterns/

vulnerabilities/

Keep looking

Skills are one crate of 326,871. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.