audit-context-building

Performs line-by-line code analysis to build architectural context before security audits.

Updated Mar 22, 2026
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill audit-context-building-tech-hy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-context-building
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/audit-context-building
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill audit-context-building-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security audits and architecture reviews often fail because reviewers jump to vulnerability hunting with only gist-level understanding, leading to hallucinated findings, missed edge cases, and lost context. This Skill enforces a disciplined, ultra-granular context-building phase so every conclusion is grounded in actual code. ## Core Features & Use Cases - Line-by-Line Micro-Analysis: Applies First Principles, 5 Whys, and 5 Hows to every function block, documenting purpose, inputs, outputs, invariants, and assumptions. - Cross-Function Flow Tracing: Follows internal and external calls as one continuous execution flow, treating unknown external contracts as adversarial. - Structured Quality Gates: Ships with an output requirements spec, a completeness checklist, and a full worked example of a DEX swap function analysis. - Use Case: Before auditing a Solidity DeFi protocol, activate this Skill to systematically map state variables, trust boundaries, and end-to-end workflows, producing an evidence-linked mental model that the later vulnerability-hunting phase can rely on. ## Quick Start Use the audit-context-building skill to perform a line-by-line analysis of the contracts in this repository and build a complete architectural model before any vulnerability review.

Frequently Asked Questions about audit-context-building

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build deep code context before a security audit?

Analyze each function line-by-line, documenting purpose, inputs, outputs, invariants, and assumptions per block. Apply First Principles and 5 Whys to understand design rationale, then trace calls across functions to reconstruct workflows and trust boundaries before hunting for bugs.

What is line-by-line smart contract analysis?

Line-by-line smart contract analysis examines every code block for what it does, why it is placed there, what assumptions it relies on, and what invariants it maintains. It propagates these findings across internal and external calls to build a continuous execution model.

How should external contract calls be analyzed during an audit?

If the external contract's code exists in the codebase, jump into it and continue the same micro-analysis. If the code is unavailable, treat the call as adversarial: model reverts, strange return values, unexpected state changes, and reentrancy.

When should I not use a context-building analysis phase?

Skip it when you only need a quick surface review or when the task is already about vulnerability reporting, fix recommendations, or exploit modeling. This phase is pure comprehension and deliberately excludes severity ratings and proof-of-concept work.

Why do AI code audits produce hallucinated vulnerabilities?

Hallucinations come from gist-level understanding, unstated assumptions, and degraded context over long sessions. Writing down invariants, citing line numbers, and explicitly updating contradicted assumptions keeps findings evidence-based.