solidity-auditor

Audits Solidity smart contracts for vulnerabilities using parallel scanning agents and a 170-vector attack reference.

6|20|Updated Mar 14, 2026
One-click install
npx skills add https://github.com/andresdefi/cryptoskills --skill solidity-auditor-andresdefi
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: solidity-auditor
Source: https://github.com/andresdefi/cryptoskills/tree/main/skills/solidity-auditor
Command: npx skills add https://github.com/andresdefi/cryptoskills --skill solidity-auditor-andresdefi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Smart contract bugs can drain funds, yet manual security reviews are slow and expensive. This Skill runs an automated security audit of Solidity code while you develop, surfacing high-confidence findings in minutes before every commit. ## Core Features & Use Cases - Parallel Multi-Agent Scanning: Orchestrates four vector-scanning agents that each check the full codebase against a 170-item attack vector reference covering reentrancy, oracle manipulation, proxy storage collisions, ERC4626 inflation attacks, and more. - Deep Adversarial Mode: The deep mode spawns an additional adversarial reasoning agent that hunts for logic errors, economic exploits, and multi-transaction attack paths beyond pattern matching. - Confidence-Scored Reports: Every finding passes a false-positive gate, receives a confidence score, and is merged, deduplicated, and formatted into a structured markdown report with diff-style fixes. - Use Case: Before deploying a new vault contract, run the audit on src/Vault.sol to catch missing access controls, unchecked return values, and reentrancy issues, then write the findings to a report file with the --file-output flag. ## Quick Start Ask the agent to run a security audit on your Solidity repository, or pass a specific contract filename to review just that file.

Frequently Asked Questions about solidity-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Solidity smart contract for vulnerabilities?

Run the audit command with no arguments to scan all in-scope .sol files in the repository, or pass specific filenames to review individual contracts. The skill spawns parallel agents that check the code against 170 known attack vectors and returns a confidence-scored findings report.

What is the difference between default and deep audit mode?

Default mode runs four vector-scanning agents across the full repository. Deep mode adds a fifth adversarial reasoning agent that hunts for logic errors, economic exploits, and multi-transaction attack paths, making it slower and more costly but more thorough.

What kinds of vulnerabilities does a Solidity security audit detect?

It detects reentrancy, missing access controls, oracle manipulation, signature replay, ERC4626 inflation attacks, proxy storage collisions, unchecked return values, and cross-chain message spoofing, among 170 documented attack vectors with false-positive guidance for each.

What are the limitations of AI smart contract auditing?

Accuracy drops on codebases past roughly 5,000 lines, so large projects should be audited per module. AI struggles with multi-transaction state setups, invariant bugs, cross-protocol composability, and game-theory attacks, so it complements rather than replaces manual review.

Can I save the audit findings to a file?

Yes, pass the --file-output flag to write the report to a timestamped markdown file under the assets/findings directory. Without this flag, findings are printed to the terminal only and no report file is created.