audit-prep-assistant

Prepares codebases for security audits using Trail of Bits' review checklist.

Updated Mar 22, 2026
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill audit-prep-assistant-tech-hy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-prep-assistant
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/audit-prep-assistant
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill audit-prep-assistant-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security audits are more effective when the codebase arrives well-prepared, but teams often hand auditors messy code with missing documentation, stale static analysis results, and unclear scope. This Skill walks you through Trail of Bits' preparation checklist so auditors can focus on real vulnerabilities instead of setup friction. ## Core Features & Use Cases - Static Analysis & Cleanup: Runs platform-appropriate tools (Slither for Solidity, dylint for Rust, golangci-lint for Go, CodeQL/Semgrep) and helps triage findings, raise test coverage, and remove dead code. - Accessibility Package: Produces scoped file lists, verified build instructions, frozen commit/branch identification, and boilerplate attribution. - Documentation Generation: Creates flowcharts, sequence diagrams, user stories, actor/privilege maps, glossaries, and NatSpec-style function documentation. - Use Case: Two weeks before a Trail of Bits review of your Solidity DeFi protocol, use this Skill to run Slither, push coverage above 80%, freeze an audit branch, and generate the full documentation package to hand to the assessment team. ## Quick Start Ask the assistant to prepare your repository for an upcoming security audit by running static analysis, checking test coverage, and generating the audit documentation package.

Frequently Asked Questions about audit-prep-assistant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prepare my codebase for a security audit?

Follow a structured checklist: document review goals, run static analysis tools for your platform, raise test coverage above 80%, remove dead code, freeze a stable commit, and generate architecture documentation. This Skill guides each step and tracks progress with a checklist.

What static analysis tools should I run before a smart contract audit?

For Solidity, run Slither with the --exclude-dependencies flag. Rust projects use dylint, Go projects use golangci-lint, and Go, Rust, or C++ codebases can additionally run CodeQL and Semgrep checks. Triage all findings and document accepted risks.

Does this work for Rust or Go projects, or only Solidity?

It supports multiple platforms. The preparation workflow adapts its tooling based on your stack: Slither for Solidity, dylint for Rust, golangci-lint for Go, and CodeQL or Semgrep for Go, Rust, and C++.

When should I start preparing for a security review?

Start one to two weeks before the audit. Set review goals and run static analysis two weeks out, raise coverage and freeze the version one week out, and finish documentation and build verification in the final days.

What documentation do security auditors expect before a review?

Auditors expect a scoped file list, verified build instructions, a frozen commit hash, architecture flowcharts, user stories, an actor and privilege map, documented assumptions, function-level comments with invariants, and a glossary of domain terms.