audit-prep-assistant

Prepares codebases for security audits using Trail of Bits' checklist methodology.

Updated Apr 3, 2026
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-prep-assistant-ayoub-ouederni
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-prep-assistant
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/audit-prep-assistant
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill audit-prep-assistant-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security audits fail or stall when codebases arrive unprepared: unresolved static analysis findings, low test coverage, dead code, missing build instructions, and absent documentation force auditors to waste time on issues that could have been fixed beforehand. ## Core Features & Use Cases - Review Goal Setting: Documents security objectives, areas of concern, worst-case scenarios, and questions for auditors. - Static Analysis & Cleanup: Runs Slither for Solidity, dylint for Rust, golangci-lint for Go, plus CodeQL and Semgrep, then triages findings and removes dead code. - Documentation Generation: Produces flowcharts, sequence diagrams, user stories, actor/privilege maps, glossaries, and NatSpec function documentation. - Use Case: Two weeks before a Trail of Bits audit of a Solidity DeFi protocol, use this Skill to run Slither, measure Forge test coverage, freeze an audit branch, and generate a complete prep package with architecture diagrams and build instructions. ## Quick Start Help me prepare my Solidity codebase for an upcoming security audit by running static analysis and generating the audit prep checklist.

Frequently Asked Questions about audit-prep-assistant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prepare my codebase for a security audit?

Follow a four-step process: set review goals documenting your concerns, run static analysis tools and fix easy issues, ensure code accessibility with build instructions and a frozen commit, and generate documentation like flowcharts and user stories. Start 1-2 weeks before the audit date.

What static analysis tools should I run before a smart contract audit?

For Solidity, run Slither with the --exclude-dependencies flag. Rust projects use dylint, Go projects use golangci-lint, and Go, Rust, or C++ codebases can also run CodeQL and Semgrep checks. Triage all findings and document accepted risks.

Does audit preparation work for Rust and Go projects?

Yes, the process supports Solidity, Rust, Go, and C++ codebases. Each language has designated static analysis tooling, and the documentation, test coverage, and code freeze steps apply regardless of platform.

What documentation do security auditors need before a review?

Auditors need flowcharts and sequence diagrams of primary workflows, user stories, on-chain and off-chain assumptions, an actors and privileges map, function-level documentation with invariants and parameter ranges, a glossary of domain terms, and verified build instructions.

When should I freeze the code version before an audit?

Freeze the version well before the audit, not at the last minute. Identify the commit hash, create a dedicated branch, tag the release, and lock dependencies so auditors review a stable, reproducible snapshot of the code.