Crypto audit router
Skill Yue-Zhou1/zkcrypto-audit/plugins/core-audit-flow/skills/crypto-audit-router
An agentic skills framework for security auditing of zero-knowledge systems and cryptographic protocols.
npx -y skills add Yue-Zhou1/zkcrypto-audit --skill crypto-audit-routerAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Route a full cryptographic or ZK audit across the framework. Use when you need to decide which skill should run next, which domain auditors apply, or how to move from initial context to verified finding, report, and index flow.
SKILL.md
3.3 KB, as published. Nobody here has run it
crypto-audit-router
Top-level orchestrator for the crypto audit framework.
When to Use
- Starting a new audit and deciding the execution order
- Choosing between
ecc-pairing-auditor,zk-circuit-auditor,dkg-threshold-auditor,rust-crypto-safety, orspec-delta-checker - Moving a suspected issue from domain review to verification, reporting, and indexing
- Coordinating multi-skill audits without losing handoff artifacts
When NOT to Use
- Replacing the domain auditors themselves
- Writing final findings without
crypto-fp-check - Querying or writing prior art directly without deciding whether the finding is verified and citable
Rationalizations to Reject
| Rationalization | Why it is wrong |
|---|---|
| "No ZK code, skip zk-circuit-auditor" | Fiat-Shamir transcripts appear outside ZK circuits too |
| "It's just Rust safety, no crypto-specific review needed" | rust-crypto-safety covers timing, zeroize, and unsafe, which are crypto-specific |
| "We already ran spec-delta-checker, skip domain audit" | spec-delta-checker finds drift; domain auditors find implementation bugs unrelated to the spec |
Workflow
- Load machine-readable route metadata from
../../../_meta/router-matrix.yaml - Load machine-readable skill trigger metadata from
../../../_meta/codex-skill-registry.yaml - Read
references/routing-matrix.mdas the human-readable mirror of registry policy - Execute
workflows/full-audit-flow.mdto keep the end-to-end sequence consistent - Preserve the output contract from each skill before routing to the next one
Routing Authority
- Auto-routing eligibility is determined by
trigger_modein../../../_meta/codex-skill-registry.yaml. trigger_mode: router_autoskills are eligible when predicates match.trigger_mode: user_triggered_onlyskills must never be auto-selected.agents/openai.yamlprovides UI/discovery metadata only and does not override routing policy.
Session State Enforcement
- Every handoff must preserve schema validity against
zk-findings/sessions/session-state-schema.json. - Use
references/state-machine.mdto enforce legal phase transitions and mutation boundaries (open_findings->verified_findings,next_stepsrefresh, closeout checks). - If any required session-state field is missing, route back to the earliest phase that can repair the state before progressing.
Routing Scope
This router is responsible for sequencing crypto-audit-context,
spec-delta-checker, the domain auditors, crypto-fp-check,
crypto-report-writer, and zkbugs-index.
Output Contract
Produce an audit routing plan that includes:
- The chosen skill sequence and why each skill was selected
- The current artifact handed from one phase to the next
- The stop condition for each phase
- The next unresolved branch or escalation point