A multi-chain security audit tool for smart contracts that automates vulnerability detection, checklist review, and reporting.
Install
mkdir -p .claude/skills/skills-0x-shashi && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/15404" && unzip -o skill.zip -d .claude/skills/skills-0x-shashi && rm skill.zipInstalls to .claude/skills/skills-0x-shashi
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Root skill definition for the Web3 Audit Plugin providing AI-powered smart contract security auditing across EVM, Solana, Move, Cairo, CosmWasm, and TON platforms. Use as the top-level entry point for understanding plugin capabilities, supported chains, and skill routing.Key capabilities
- →Analyze smart contract code across multiple blockchain platforms
- →Detect vulnerabilities using pattern-based detection
- →Apply protocol-specific audit checklists
- →Perform attack chain analysis for exploit detection
- →Classify vulnerability severity automatically
- →Generate audit reports with findings templates
How it works
The plugin loads target smart contract code, identifies chain and protocol, runs appropriate scanner skills, applies checklists, checks attack chain patterns, and generates an audit report.
Inputs & outputs
When to use skills
- →Audit Solidity contracts
- →Scan for vulnerabilities
- →Generate security audit reports
- →Check smart contract attack chains
About this skill
Web3 Audit Plugin - Core Skill Definition
Purpose
This plugin provides AI-powered smart contract security auditing capabilities across multiple blockchain platforms.
Capabilities
- Multi-chain smart contract analysis (EVM, Solana, Move, Cairo, CosmWasm, TON)
- Pattern-based vulnerability detection using 200+ known patterns
- Protocol-specific audit checklists (DeFi, NFT, Bridge, Governance)
- Attack chain analysis for multi-step exploit detection
- Automated severity classification
- Report generation with findings templates
Usage
- Load the target smart contract code
- Identify the chain and protocol type
- Run appropriate scanner skill
- Apply relevant checklist
- Check attack chain patterns
- Generate audit report
Skill Chain
Context Building → Scanner → Checklist → Attack Chains → Report
Available Scanners
- Solidity Scanner (EVM chains)
- Solana Scanner (Rust/Anchor)
- Cairo Scanner (Starknet)
- Move Scanner (Aptos/Sui)
- Cosmos Scanner (CosmWasm/SDK)
- TON Scanner (FunC/Tact)
- Aptos Scanner (Move/Aptos)
- Sui Scanner (Sui Move)
- Starknet Scanner (Cairo)
- Aztec Scanner (Noir)
- Fuel Scanner (Sway)
Prerequisites
The plugin requires an AI model with tool-use capabilities. Each scanner skill may have chain-specific prerequisites (e.g., Solana scanner requires familiarity with Anchor framework).
Validation
To verify installation and test skill loading:
# Validate all SKILL.md files pass quality threshold
python scripts/quality-check.py --all --min-score 8
# Example trigger routing
trigger: "audit solidity"
route_to: solidity-scanner/SKILL.md
load: [checklists, patterns, severity]
# Verify scanner availability
ls skills/*/SKILL.md | wc -l # Should show 29+ skills
Behavior Guidelines
- Scanner selection is required based on detected chain type
- Protocol template loading is optional but recommended
- Severity classification MUST follow the decision tree in
patterns/severity-scoring.md - Auditors may optionally skip gas optimization checks depending on engagement scope
References
- Core References - Architecture diagrams and skill routing maps
When not to use it
- →When auditing non-smart contract code
- →When a user needs to fix vulnerabilities, not just identify them
- →When the AI model lacks tool-use capabilities
Prerequisites
Limitations
- →Requires an AI model with tool-use capabilities
- →Each scanner skill may have chain-specific prerequisites
- →Severity classification MUST follow a defined decision tree
How it compares
This skill provides an AI-powered, multi-chain smart contract security auditing workflow with pattern-based detection and automated report generation, unlike manual security reviews.
Compared to similar skills
skills side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| skills (this skill) | 0 | 5mo | Review | Intermediate |
| security-header-generator | 5 | 9mo | Caution | Intermediate |
| backend-security-coder | 24 | 4mo | No flags | Intermediate |
| firebase | 20 | 6mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by 0x-Shashi
View all by 0x-Shashi →You might also like
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
firebase
davila7
Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model. This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I
api-security-best-practices
davila7
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
blockchain-developer
sickn33
Build production-ready Web3 applications, smart contracts, and decentralized systems. Implements DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integrations. Use PROACTIVELY for smart contracts, Web3 apps, DeFi protocols, or blockchain infrastructure.
file-uploads
davila7
Expert at handling file uploads and cloud storage. Covers S3, Cloudflare R2, presigned URLs, multipart uploads, and image optimization. Knows how to handle large files without blocking. Use when: file upload, S3, R2, presigned URL, multipart.