Commands 0x Shashi Web3 Audit Skills

Commands Skill

Purpose

Provides structured command patterns for invoking audit capabilities through the plugin. Each command maps to one or more underlying skills, loads the correct context, and executes the appropriate workflow.

Command Reference

/audit <contract|directory>

Purpose: Run a full comprehensive security audit.

Skills invoked: solidity-scanner → methodology/comprehensive-audit → checklists → report-writer

Example:

/audit src/Vault.sol --chain arbitrum --type defi

Output: Full audit report with findings grouped by severity, root cause analysis, PoC code, and fix recommendations.

/scan <contract>

Purpose: Fast 15–20 minute vulnerability scan for triage or contest warm-up.

Skills invoked: solidity-scanner/workflows/quick-scan → severity/SKILL.md

Example:

/scan src/LendingPool.sol --focus reentrancy

Output: Prioritized list of potential vulnerabilities with severity estimates and quick-fix suggestions.

/checklist <protocol-type>

Purpose: Load a protocol-specific security checklist.

Available checklists:

Skills invoked: checklists/ → protocol-specific checklist file

Example:

/checklist erc4626

/report

Purpose: Generate formatted audit report from collected findings.

Skills invoked: report-writer/SKILL.md

Output structure:

1. Executive Summary
2. Scope and Methodology
3. Findings (Critical → High → Medium → Low → Informational)
4. Each finding: Title, Severity, Description, Impact, PoC, Recommendation
5. Appendix: Tool outputs, gas analysis

Example:

/report --format markdown --template contest

/severity <finding-description>

Purpose: Classify a finding's severity using structured criteria.

Skills invoked: severity/SKILL.md → scoring/SKILL.md

Assessment criteria applied:

1. Impact: What can go wrong? (fund loss, DoS, governance)
2. Likelihood: How likely is exploitation? (attacker cost, prerequisites)
3. Scope: Who is affected? (single user, all users, protocol)
4. Existing mitigations: Any guards already in place?

Example:

/severity "reentrancy in withdraw() allows drain" --context "vault holds 10M USDC"

Output: Severity rating (Critical/High/Medium/Low) with detailed justification and comparable historical findings.

/patterns <category>

Purpose: Browse the vulnerability pattern catalog for a specific category.

Available categories:

Skills invoked: patterns/SKILL.md → variant-analysis/resources/variant-patterns.md

Example:

/patterns reentrancy

/chain-guide <chain>

Purpose: Load chain-specific security considerations and audit context.

Supported chains:

Skills invoked: chain-guides/ → chain-specific scanner SKILL.md

Example:

/chain-guide solana --focus accounts

/fix-review <finding-id>

Purpose: Review a proposed fix to verify it correctly addresses the vulnerability.

Skills invoked: fix-review/SKILL.md → variant-analysis/SKILL.md

Checks performed:

1. Root cause addressed (not just symptom)
2. No new vulnerabilities introduced
3. All variant instances also fixed
4. Edge cases covered
5. Tests added for the vulnerability
6. No regressions to existing functionality

Example:

/fix-review H-01 --diff fix/reentrancy..main

/variant <bug-description>

Purpose: Run variant analysis from a known bug to find all related instances.

Skills invoked: variant-analysis/SKILL.md → variant-analysis/workflows/variant-hunt.md

Example:

/variant "unchecked return value in transfer" --scope all

/exploit <protocol-name>

Purpose: Load historical exploit forensics for a protocol or exploit category.

Skills invoked: exploit-forensics/ → specific case study file

Example:

/exploit euler

Command Chaining

Commands can be logically chained for complex workflows:

/scan Vault.sol                          → Find initial vulnerabilities
/variant "reentrancy in withdraw()"      → Find all variants
/severity "reentrancy across 3 functions" → Classify aggregate severity
/report --template contest               → Generate contest submission

Error Handling

Resources

• Implementation Guide