audit-context-building

Performs line-by-line code analysis to build architectural context before security auditing.

Updated Apr 5, 2026
One-click install
npx skills add https://github.com/marumo333/atrox --skill audit-context-building-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-context-building
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/audit-context-building/skills/audit-context-building
Command: npx skills add https://github.com/marumo333/atrox --skill audit-context-building-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security audits often fail because reviewers jump to vulnerability hunting with only gist-level understanding, leading to hallucinated findings, missed edge cases, and lost context. This Skill enforces a disciplined, ultra-granular context-building phase so every function, invariant, and trust boundary is understood before any bug finding begins. ## Core Features & Use Cases - Ultra-Granular Function Analysis: Applies a per-function microstructure checklist covering purpose, inputs, outputs, block-by-block reasoning, and cross-function dependencies, using First Principles, 5 Whys, and 5 Hows. - Cross-Boundary Flow Tracing: Treats internal and external calls as one continuous execution flow, propagating invariants and modeling black-box external contracts as adversarial. - Quality Gates & Anti-Hallucination Rules: Enforces minimum thresholds (3 invariants, 5 assumptions, 3 risk considerations per function), line-number citations, and explicit correction of contradicted assumptions. - Use Case: Before auditing a Solidity DEX router, activate this Skill to produce a complete micro-analysis of the swap function—including fee math verification, reentrancy risk mapping, and invariant coupling—so the later vulnerability-hunting phase starts from verified understanding. ## Quick Start Analyze this codebase function by function using ultra-granular context building before we look for any vulnerabilities.

Frequently Asked Questions about audit-context-building

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build deep code context before a security audit?▼

Perform a bottom-up scan to map modules, entrypoints, actors, and state variables, then analyze each non-trivial function block by block. Document purpose, inputs, outputs, invariants, and assumptions, and trace every internal and external call as one continuous flow.

What is the best way to analyze smart contract functions line by line?▼

Use a per-function microstructure checklist: state the purpose, list all parameters and implicit inputs with trust levels, document state writes and external calls, then apply First Principles, 5 Whys, and 5 Hows to each logical block with line-number citations.

How should external contract calls be handled during code analysis?▼

If the callee's code exists in the codebase, jump into it and continue block-by-block analysis. If it is a true black box, model it as adversarial: consider reverts, strange return values, unexpected state changes, and reentrancy.

When should I not use deep context-building analysis?▼

Skip it when you only need vulnerability findings, fix recommendations, exploit reasoning, or severity ratings. This approach is pure context building and explicitly runs before the vulnerability-hunting, triage, and reporting phases.

Why do AI code audits produce hallucinated vulnerabilities?▼

Hallucinations come from gist-level understanding and degraded context. Prevent them by writing down invariants explicitly, citing line numbers for every claim, replacing vague guesses with 'unclear; need to inspect X', and updating the model when evidence contradicts earlier assumptions.