web3-audit

Identify Solidity smart contract vulnerabilities across DeFi protocols.

13|2|Updated Jun 1, 2026
One-click install
npx skills add https://github.com/chatbotkit/rook --skill web3-audit-chatbotkit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web3-audit
Source: https://github.com/chatbotkit/rook/tree/main/skills/web3-audit
Command: npx skills add https://github.com/chatbotkit/rook --skill web3-audit-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Smart contract security auditing for DeFi protocols, identifying vulnerabilities before exploitation.

Core Features & Use Cases

  • Ten bug classes coverage including accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, and proxy.
  • Pre-dive kill signals and risk-based engagement heuristics to triage targets.
  • Foundry PoC templates and grep-patterns for rapid triage and reproducible proofs-of-concept.
  • Real Immunefi paid examples to calibrate impact and reporting standards.

Quick Start

Use the Foundry PoC template to reproduce a vulnerability on your Solidity contracts.

Frequently Asked Questions about web3-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Solidity smart contract for DeFi vulnerabilities?

To audit a Solidity smart contract for DeFi vulnerabilities, use pre-dive kill signals to triage targets, apply grep patterns across ten bug classes, and execute Foundry PoC templates to reproduce findings.

What bug classes are covered in a DeFi smart contract security audit?

A DeFi smart contract security audit covers ten bug classes: accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, and proxy vulnerabilities.

Do I need Foundry to run smart contract vulnerability proofs of concept?

Yes, you need Foundry installed to execute smart contract vulnerability proofs of concept. The audit process requires Foundry to run PoC templates that reproduce identified vulnerabilities and generate reproducible reports.

How do I triage DeFi protocols for security risks before a full audit?

To triage DeFi protocols for security risks before a full audit, apply risk-based engagement heuristics and pre-dive kill signals, then use grep-based patterns across Solidity and Rust targets to quickly identify potential exposure.

Can I use grep patterns to find reentrancy and flash loan vulnerabilities in Solidity?

Yes, you can use grep patterns to find reentrancy and flash loan vulnerabilities in Solidity. The audit process provides specific grep-based triage patterns for each of the ten bug classes across Solidity and Rust targets.

How do I estimate the impact of a discovered smart contract vulnerability?

To estimate the impact of a discovered smart contract vulnerability, calibrate findings against real Immunefi paid examples. The audit generates a reproducible report containing PoCs and impact estimates for each identified issue.