How do I install the Crypto Audit Router skill?

Run npx skillmds@latest add yue-zhou1/crypto-audit-router-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Crypto Audit Router safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Crypto Audit Router?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Crypto Audit Router free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Crypto Audit Router?

Yue-Zhou1 (@yue-zhou1) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Crypto Audit Router by yue-zhou1 — Agent Skill

Name: Crypto Audit Router
Author: Yue-Zhou1

Crypto Audit Router

Route a full cryptographic or ZK audit across the framework. Use when you need to decide which skill should run next, which domain auditors apply, or how to move from initial context to verified finding, report, and index flow.

Yue-Zhou1 Updated Sep 17, 2026

File contents

crypto-audit-router

Top-level orchestrator for the crypto audit framework.

When to Use

Starting a new audit and deciding the execution order
Choosing between ecc-pairing-auditor, zk-circuit-auditor, dkg-threshold-auditor, rust-crypto-safety, or spec-delta-checker
Moving a suspected issue from domain review to verification, reporting, and indexing
Coordinating multi-skill audits without losing handoff artifacts

When NOT to Use

Replacing the domain auditors themselves
Writing final findings without crypto-fp-check
Querying or writing prior art directly without deciding whether the finding is verified and citable

Rationalizations to Reject

Rationalization	Why it is wrong
"No ZK code, skip zk-circuit-auditor"	Fiat-Shamir transcripts appear outside ZK circuits too
"It's just Rust safety, no crypto-specific review needed"	`rust-crypto-safety` covers timing, zeroize, and `unsafe`, which are crypto-specific
"We already ran spec-delta-checker, skip domain audit"	`spec-delta-checker` finds drift; domain auditors find implementation bugs unrelated to the spec

Workflow

Load machine-readable route metadata from ../../../_meta/router-matrix.yaml
Load machine-readable skill trigger metadata from ../../../_meta/codex-skill-registry.yaml
Read references/routing-matrix.md as the human-readable mirror of registry policy
Execute workflows/full-audit-flow.md to keep the end-to-end sequence consistent
Preserve the output contract from each skill before routing to the next one

Routing Authority

Auto-routing eligibility is determined by trigger_mode in ../../../_meta/codex-skill-registry.yaml.
trigger_mode: router_auto skills are eligible when predicates match.
trigger_mode: user_triggered_only skills must never be auto-selected.
agents/openai.yaml provides UI/discovery metadata only and does not override routing policy.

Session State Enforcement

Every handoff must preserve schema validity against zk-findings/sessions/session-state-schema.json.
Use references/state-machine.md to enforce legal phase transitions and mutation boundaries (open_findings -> verified_findings, next_steps refresh, closeout checks).
If any required session-state field is missing, route back to the earliest phase that can repair the state before progressing.

Routing Scope

This router is responsible for sequencing crypto-audit-context, spec-delta-checker, the domain auditors, crypto-fp-check, crypto-report-writer, and zkbugs-index.

Output Contract

Produce an audit routing plan that includes:

The chosen skill sequence and why each skill was selected
The current artifact handed from one phase to the next
The stop condition for each phase
The next unresolved branch or escalation point

Reference Index

references/routing-matrix.md
references/state-machine.md
workflows/full-audit-flow.md

---name: crypto-audit-router-2description: Route a full cryptographic or ZK audit across the framework. Use when you need to decide which skill should run next, which domain auditors apply, or how to move from initial context to verified finding, report, and index flow.---# crypto-audit-routerTop-level orchestrator for the crypto audit framework.## When to Use- Starting a new audit and deciding the execution order- Choosing between `ecc-pairing-auditor`, `zk-circuit-auditor`, `dkg-threshold-auditor`, `rust-crypto-safety`, or `spec-delta-checker`- Moving a suspected issue from domain review to verification, reporting, and indexing- Coordinating multi-skill audits without losing handoff artifacts## When NOT to Use- Replacing the domain auditors themselves- Writing final findings without `crypto-fp-check`- Querying or writing prior art directly without deciding whether the finding is verified and citable## Rationalizations to Reject| Rationalization | Why it is wrong ||---|---|| "No ZK code, skip zk-circuit-auditor" | Fiat-Shamir transcripts appear outside ZK circuits too || "It's just Rust safety, no crypto-specific review needed" | `rust-crypto-safety` covers timing, zeroize, and `unsafe`, which are crypto-specific || "We already ran spec-delta-checker, skip domain audit" | `spec-delta-checker` finds drift; domain auditors find implementation bugs unrelated to the spec |## Workflow- Load machine-readable route metadata from `../../../_meta/router-matrix.yaml`- Load machine-readable skill trigger metadata from `../../../_meta/codex-skill-registry.yaml`- Read `references/routing-matrix.md` as the human-readable mirror of registry policy- Execute `workflows/full-audit-flow.md` to keep the end-to-end sequence consistent- Preserve the output contract from each skill before routing to the next one## Routing Authority- Auto-routing eligibility is determined by `trigger_mode` in `../../../_meta/codex-skill-registry.yaml`.- `trigger_mode: router_auto` skills are eligible when predicates match.- `trigger_mode: user_triggered_only` skills must never be auto-selected.- `agents/openai.yaml` provides UI/discovery metadata only and does not override routing policy.## Session State Enforcement- Every handoff must preserve schema validity against `zk-findings/sessions/session-state-schema.json`.- Use `references/state-machine.md` to enforce legal phase transitions and mutation boundaries (`open_findings` -> `verified_findings`, `next_steps` refresh, closeout checks).- If any required session-state field is missing, route back to the earliest phase that can repair the state before progressing.## Routing ScopeThis router is responsible for sequencing `crypto-audit-context`,`spec-delta-checker`, the domain auditors, `crypto-fp-check`,`crypto-report-writer`, and `zkbugs-index`.## Output ContractProduce an audit routing plan that includes:- The chosen skill sequence and why each skill was selected- The current artifact handed from one phase to the next- The stop condition for each phase- The next unresolved branch or escalation point## Reference Index- [references/routing-matrix.md](references/routing-matrix.md)- [references/state-machine.md](references/state-machine.md)- [workflows/full-audit-flow.md](workflows/full-audit-flow.md)

Frequently asked questions