agentsclimarketplace
Sign in

Gnark auditor

Skill Yue-Zhou1/zkcrypto-audit/plugins/zk-and-vm-auditors/skills/gnark-auditor

Audit gnark circuits and Go witness pipelines for frontend/backend mismatch, public/private witness exposure, constraint API misuse, and serialization boundary errors.From its SKILL.md

Install
npx -y skills add Yue-Zhou1/zkcrypto-audit --skill gnark-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 504 tokens by cl100k_base, as published. Nobody here has run it

gnark-auditor

Domain auditor for gnark circuit code and Go-side witness assignment paths.

When to Use

  • Auditing frontend.API constraints against generated backend systems
  • Reviewing public/private witness declarations and assignment flows
  • Checking Go witness construction and serialization/deserialization boundaries
  • Reviewing AssertIsEqual, selectors, hints, and range assumptions in constraints
  • Validating curve and field parameter configuration across setup and proving

When NOT to Use

  • Multi-DSL ZK circuit reviews not centered on gnark — use zk-circuit-auditor
  • Rust unsafe, zeroization, or feature-flag issues — use rust-crypto-safety
  • Declaring a suspected gnark issue confirmed without verification gates

Core Review Areas

  1. Frontend/backend mismatch between frontend.API intent and generated constraint system
  2. Public/private witness binding and accidental data promotion
  3. Go-side witness assignment and serialization boundaries
  4. Constraint API misuse (AssertIsEqual, selectors, hints, range assumptions)
  5. Curve/field parameter mismatches and unsafe defaults

Workflow

Phase 1: Frontend/backend trace

  • Read references/gnark-checklist.md
  • Execute workflows/frontend-backend-review.md
  • Trace each security-critical value from frontend declarations to backend constraints

Phase 2: Assignment and boundary review

  • Verify public witness declarations match protocol expectations
  • Review Go witness assignment and error handling before serialization
  • Check witness decode paths for permissive defaults or silent coercions

Phase 3: Pattern hunt

  • Read references/finding-patterns.md
  • Prioritize frontend/backend mismatch, witness exposure, and modulus confusion patterns

Phase 4: Handoff

  • Send surviving findings to crypto-fp-check
  • Use zkbugs-index only after the finding survives verification

Output Contract

Produce a gnark-specific handoff that includes:

  • The frontend API declarations and backend constraints involved
  • The witness visibility or serialization boundary under review
  • Whether the issue is mismatch, witness exposure, assignment, API misuse, or field-parameter related
  • The next verification or reporting route

Reference Index

What ships with it: 4 files

3.7 KB alongside SKILL.md

agents/

references/

workflows/

Keep looking

Skills are one crate of 326,852. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.