How do I install the Cadence Audit skill?

Run npx skillmds@latest add onflow/cadence-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cadence Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cadence Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cadence Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cadence Audit?

onflow (@onflow) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cadence Audit by onflow — Agent Skill

Name: Cadence Audit
Author: onflow

Cadence Audit

Comprehensive audit and review skill for Cadence smart contracts on the Flow blockchain. Identifies security vulnerabilities, bugs, code quality issues, and optimization opportunities. Produces severity-rated findings (Critical/High/Medium/Low) with actionable fixes. TRIGGER when: auditing, reviewing, or improving Cadence code, checking for security issues, performing code review on .cdc files, looking for anti-patterns or vulnerabilities, optimizing smart contract code, "review cadence", "audit cadence", "check cadence security", "validate cadence contract", "review my .cdc file", "security review", "code review", "find vulnerabilities", "check this contract", "is this code secure", "audit my project". DO NOT TRIGGER when: writing new contracts from scratch (use cadence-scaffold), asking about Cadence syntax or patterns (use cadence-lang), building token contracts (use cadence-tokens).

onflow d896307 3 files · 14.0 KB Updated Sep 17, 2026

File contents

Cadence Smart Contract Audit

Conduct comprehensive security, quality, and performance reviews of Cadence smart contracts.

Audit Modes

Single File Review

When reviewing a specific file or code snippet, analyze it across four dimensions and produce a structured report.

Project-Wide Audit

When auditing a full project:

Discover all .cdc files: cadence/contracts/*.cdc, cadence/transactions/*.cdc, cadence/scripts/*.cdc
If none found, search recursively from project root for *.cdc
Systematically audit each file using the checklist
Produce a project-level summary with file-by-file findings

Review Dimensions

Security — Vulnerabilities, access control, resource safety, capability management
Bugs — Nil dereferences, resource loss, type confusion, infinite loops
Code Quality — Readability, naming, documentation, patterns compliance
Optimization — Unnecessary copies, storage inefficiencies, gas usage

Quick Per-Function Checklist

Can the field be let instead of var?
Can the function be view?
Can access be more restrictive (access(self), entitled)?
Are inputs validated with pre-conditions?
Are results verified with post-conditions?
Are error messages descriptive with interpolated values?

Navigation

Reference	Content
audit-checklist.md	Full security, bugs, quality, DeFi, optimization checklists
review-format.md	Structured output format, severity levels, verdict criteria

Companion Skills

cadence-lang — Essential during audits. Consult for access control rules, entitlement patterns, resource safety, anti-patterns, and design patterns. Every audit finding should reference the specific Cadence rule being violated.
cadence-tokens — Consult when auditing NFT/FT contracts for standard compliance (NonFungibleToken interface, MetadataViews requirements).
cadence-testing — Use to follow up on audit findings like "missing test coverage" or "edge case not tested" with concrete test-writing guidance.

---name: cadence-auditdescription: Comprehensive audit and review skill for Cadence smart contracts on the Flow blockchain. Identifies security vulnerabilities, bugs, code quality issues, and optimization opportunities. Produces severity-rated findings (Critical/High/Medium/Low) with actionable fixes. TRIGGER when: auditing, reviewing, or improving Cadence code, checking for security issues, performing code review on .cdc files, looking for anti-patterns or vulnerabilities, optimizing smart contract code, "review cadence", "audit cadence", "check cadence security", "validate cadence contract", "review my .cdc file", "security review", "code review", "find vulnerabilities", "check this contract", "is this code secure", "audit my project". DO NOT TRIGGER when: writing new contracts from scratch (use cadence-scaffold), asking about Cadence syntax or patterns (use cadence-lang), building token contracts (use cadence-tokens).---# Cadence Smart Contract AuditConduct comprehensive security, quality, and performance reviews of Cadence smart contracts.## Audit Modes### Single File ReviewWhen reviewing a specific file or code snippet, analyze it across four dimensions and produce a structured report.### Project-Wide AuditWhen auditing a full project:1. Discover all `.cdc` files: `cadence/contracts/*.cdc`, `cadence/transactions/*.cdc`, `cadence/scripts/*.cdc`2. If none found, search recursively from project root for `*.cdc`3. Systematically audit each file using the checklist4. Produce a project-level summary with file-by-file findings## Review Dimensions1. **Security** — Vulnerabilities, access control, resource safety, capability management2. **Bugs** — Nil dereferences, resource loss, type confusion, infinite loops3. **Code Quality** — Readability, naming, documentation, patterns compliance4. **Optimization** — Unnecessary copies, storage inefficiencies, gas usage## Quick Per-Function Checklist- Can the field be `let` instead of `var`?- Can the function be `view`?- Can access be more restrictive (`access(self)`, entitled)?- Are inputs validated with pre-conditions?- Are results verified with post-conditions?- Are error messages descriptive with interpolated values?## Navigation| Reference | Content ||-----------|---------|| [audit-checklist.md](references/audit-checklist.md) | Full security, bugs, quality, DeFi, optimization checklists || [review-format.md](references/review-format.md) | Structured output format, severity levels, verdict criteria |## Companion Skills- **`cadence-lang`** — Essential during audits. Consult for access control rules, entitlement patterns, resource safety, anti-patterns, and design patterns. Every audit finding should reference the specific Cadence rule being violated.- **`cadence-tokens`** — Consult when auditing NFT/FT contracts for standard compliance (NonFungibleToken interface, MetadataViews requirements).- **`cadence-testing`** — Use to follow up on audit findings like "missing test coverage" or "edge case not tested" with concrete test-writing guidance.

Frequently asked questions