How do I install the Audit skill?

Run npx skillmds@latest add austintgriffith-ethskills/audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

austintgriffith (@austintgriffith-ethskills) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Audit by austintgriffith-ethskills — Agent Skill

Name: Audit
Rating: 4.2 (5 reviews)
Author: austintgriffith

Audit

Deep EVM smart contract security audit system. Use when asked to audit a contract, find vulnerabilities, review code for security issues, or file security issues on a GitHub repo. Covers 500+ non-obvious checklist items across 19 domains via parallel sub-agents. Different from the security skill (which teaches defensive coding) — this is for systematically auditing contracts you didn't write.

File contents

EVM Smart Contract Audit

A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues.

The Checklists

20 specialized skills covering every major vulnerability domain. Fetch the master index first:

https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md

The master index contains:

Full routing table (which skills to load for which contract types)
The complete audit methodology (recon → parallel agents → synthesis → issues)
Standard finding format with severity definitions

All 20 skill checklists are at:

https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/<skill-name>/references/checklist.md

Skills Available

Skill	When to Load
`evm-audit-general`	Always
`evm-audit-precision-math`	Always
`evm-audit-erc20`	Contract interacts with ERC20 tokens
`evm-audit-defi-amm`	AMM, DEX, Uniswap V3/V4, liquidity pools
`evm-audit-defi-lending`	Lending, borrowing, CDP, liquidations
`evm-audit-defi-staking`	Staking, liquid staking, restaking, EigenLayer
`evm-audit-erc4626`	Vaults, share/asset conversion
`evm-audit-erc4337`	Account abstraction, paymasters, session keys
`evm-audit-bridges`	Cross-chain, LayerZero, CCIP, Wormhole
`evm-audit-proxies`	Upgradeable contracts, UUPS, Transparent, Diamond
`evm-audit-signatures`	Off-chain signatures, EIP-712, permits
`evm-audit-governance`	DAO voting, timelocks, multi-sig
`evm-audit-oracles`	Chainlink, TWAP, Pyth, price feeds
`evm-audit-assembly`	Inline assembly, Yul, CREATE2
`evm-audit-chain-specific`	Non-mainnet: Arbitrum, OP, zkSync, Blast, BSC
`evm-audit-flashloans`	Flash loan attack vectors
`evm-audit-erc721`	NFTs, ERC721, ERC1155
`evm-audit-dos`	DoS, unbounded loops, gas griefing
`evm-audit-access-control`	Ownership, roles, centralization risks

How To Run An Audit

Fetch the master skill (link above) — it has the full pipeline
Read the contract(s)
Select 5-8 skills using the routing table
Spawn one opus sub-agent per skill (parallel)
Each agent walks its checklist and writes findings-<skill>.md
Synthesize all findings into AUDIT-REPORT.md
File GitHub issues for Medium severity and above

Invocation

Audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/Foo.sol
Checklists: https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md

Sources

Built from research by Dacian, beirao.xyz, Sigma Prime, RareSkills, Decurity, weird-erc20, Spearbit, Hacken, OpenZeppelin, Cyfrin, and more. Full attribution: https://github.com/austintgriffith/evm-audit-skills#attribution--thanks

---name: auditdescription: Deep EVM smart contract security audit system. Use when asked to audit a contract, find vulnerabilities, review code for security issues, or file security issues on a GitHub repo. Covers 500+ non-obvious checklist items across 19 domains via parallel sub-agents. Different from the security skill (which teaches defensive coding) — this is for systematically auditing contracts you didn't write.--- # EVM Smart Contract Audit A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues. ## The Checklists 20 specialized skills covering every major vulnerability domain. Fetch the master index first: ``` https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md ``` The master index contains: - Full routing table (which skills to load for which contract types) - The complete audit methodology (recon → parallel agents → synthesis → issues) - Standard finding format with severity definitions All 20 skill checklists are at: ``` https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/<skill-name>/references/checklist.md ``` ## Skills Available | Skill | When to Load | |-------|-------------| | `evm-audit-general` | Always | | `evm-audit-precision-math` | Always | | `evm-audit-erc20` | Contract interacts with ERC20 tokens | | `evm-audit-defi-amm` | AMM, DEX, Uniswap V3/V4, liquidity pools | | `evm-audit-defi-lending` | Lending, borrowing, CDP, liquidations | | `evm-audit-defi-staking` | Staking, liquid staking, restaking, EigenLayer | | `evm-audit-erc4626` | Vaults, share/asset conversion | | `evm-audit-erc4337` | Account abstraction, paymasters, session keys | | `evm-audit-bridges` | Cross-chain, LayerZero, CCIP, Wormhole | | `evm-audit-proxies` | Upgradeable contracts, UUPS, Transparent, Diamond | | `evm-audit-signatures` | Off-chain signatures, EIP-712, permits | | `evm-audit-governance` | DAO voting, timelocks, multi-sig | | `evm-audit-oracles` | Chainlink, TWAP, Pyth, price feeds | | `evm-audit-assembly` | Inline assembly, Yul, CREATE2 | | `evm-audit-chain-specific` | Non-mainnet: Arbitrum, OP, zkSync, Blast, BSC | | `evm-audit-flashloans` | Flash loan attack vectors | | `evm-audit-erc721` | NFTs, ERC721, ERC1155 | | `evm-audit-dos` | DoS, unbounded loops, gas griefing | | `evm-audit-access-control` | Ownership, roles, centralization risks | ## How To Run An Audit 1. Fetch the master skill (link above) — it has the full pipeline 2. Read the contract(s) 3. Select 5-8 skills using the routing table 4. Spawn one opus sub-agent per skill (parallel) 5. Each agent walks its checklist and writes `findings-<skill>.md` 6. Synthesize all findings into `AUDIT-REPORT.md` 7. File GitHub issues for Medium severity and above ## Invocation ``` Audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/Foo.sol Checklists: https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md ``` ## Sources Built from research by Dacian, beirao.xyz, Sigma Prime, RareSkills, Decurity, weird-erc20, Spearbit, Hacken, OpenZeppelin, Cyfrin, and more. Full attribution: https://github.com/austintgriffith/evm-audit-skills#attribution--thanks

Frequently asked questions