audit-context-building

Performs line-by-line code analysis to build architectural context before security auditing.

Updated Apr 3, 2026
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-context-building-ayoub-ouederni
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-context-building
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/audit-context-building
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-context-building-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security audits often fail because reviewers jump to vulnerability hunting with only gist-level understanding, leading to hallucinated findings, missed edge cases, and contradictions. This Skill enforces a disciplined, ultra-granular context-building phase so every later audit conclusion rests on verified, line-cited understanding of the codebase. ## Core Features & Use Cases - Line-by-Line Micro-Analysis: Applies First Principles, 5 Whys, and 5 Hows to every function block, documenting purpose, inputs, outputs, invariants, and assumptions. - Cross-Function Flow Tracing: Follows internal and external calls as one continuous execution flow, treating unknown external contracts as adversarial. - Structured Quality Gates: Ships with an output requirements spec, a worked DEX swap example, and a completeness checklist enforcing minimum thresholds for invariants, assumptions, and risk analysis. - Use Case: Before auditing a Solidity DeFi protocol, activate this Skill to systematically map every function, state variable, trust boundary, and invariant, producing a stable mental model that the vulnerability-hunting phase can rely on. ## Quick Start Analyze this smart contract codebase line by line and build a complete architectural context model with invariants, assumptions, and trust boundaries before any vulnerability review.

Frequently Asked Questions about audit-context-building

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build deep code context before a security audit?

Analyze each function line by line, documenting its purpose, inputs, outputs, invariants, and assumptions. Apply First Principles and 5 Whys per block, trace all internal and external calls as one continuous flow, and verify completeness against a checklist before moving to vulnerability hunting.

What is line-by-line smart contract analysis for auditing?

It is a bottom-up review method where every logical block of Solidity code is examined for what it does, why it is placed there, what it assumes, and what invariants it maintains. This prevents gist-level misunderstandings that cause missed bugs and hallucinated findings.

How should external contract calls be analyzed during an audit?

If the external contract's code exists in the codebase, jump into it and continue block-by-block analysis. If it is a true black box, treat it as adversarial: consider reverts, strange return values, unexpected state changes, and reentrancy.

When should I not use deep context-building analysis?

Do not use it for vulnerability finding, fix recommendations, exploit reasoning, or severity rating. It is strictly a pre-audit comprehension phase; running it during triage or report writing slows those phases without adding value.

Why do AI code audits produce hallucinated vulnerabilities?

Hallucinations come from gist-level understanding, degraded context, and unverified assumptions. Writing down invariants explicitly, citing line numbers, updating the model when contradicted, and replacing vague guesses with stated uncertainty eliminates most false findings.