How do I install the Gnark Auditor skill?

Run npx skillmds@latest add yue-zhou1/gnark-auditor-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Gnark Auditor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Gnark Auditor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Gnark Auditor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Gnark Auditor?

Yue-Zhou1 (@yue-zhou1) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Gnark Auditor by yue-zhou1 — Agent Skill

Name: Gnark Auditor
Author: Yue-Zhou1

File contents

gnark-auditor

Domain auditor for gnark circuit code and Go-side witness assignment paths.

When to Use

Auditing frontend.API constraints against generated backend systems
Reviewing public/private witness declarations and assignment flows
Checking Go witness construction and serialization/deserialization boundaries
Reviewing AssertIsEqual, selectors, hints, and range assumptions in constraints
Validating curve and field parameter configuration across setup and proving

When NOT to Use

Multi-DSL ZK circuit reviews not centered on gnark — use zk-circuit-auditor
Rust unsafe, zeroization, or feature-flag issues — use rust-crypto-safety
Declaring a suspected gnark issue confirmed without verification gates

Core Review Areas

Frontend/backend mismatch between frontend.API intent and generated constraint system
Public/private witness binding and accidental data promotion
Go-side witness assignment and serialization boundaries
Constraint API misuse (AssertIsEqual, selectors, hints, range assumptions)
Curve/field parameter mismatches and unsafe defaults

Workflow

Phase 1: Frontend/backend trace

Read references/gnark-checklist.md
Execute workflows/frontend-backend-review.md
Trace each security-critical value from frontend declarations to backend constraints

Phase 2: Assignment and boundary review

Verify public witness declarations match protocol expectations
Review Go witness assignment and error handling before serialization
Check witness decode paths for permissive defaults or silent coercions

Phase 3: Pattern hunt

Read references/finding-patterns.md
Prioritize frontend/backend mismatch, witness exposure, and modulus confusion patterns

Phase 4: Handoff

Send surviving findings to crypto-fp-check
Use zkbugs-index only after the finding survives verification

Output Contract

Produce a gnark-specific handoff that includes:

The frontend API declarations and backend constraints involved
The witness visibility or serialization boundary under review
Whether the issue is mismatch, witness exposure, assignment, API misuse, or field-parameter related
The next verification or reporting route

Reference Index

references/gnark-checklist.md
references/finding-patterns.md
workflows/frontend-backend-review.md

---name: gnark-auditor-2description: Audit gnark circuits and Go witness pipelines for frontend/backend mismatch, public/private witness exposure, constraint API misuse, and serialization boundary errors.---# gnark-auditorDomain auditor for gnark circuit code and Go-side witness assignment paths.## When to Use- Auditing `frontend.API` constraints against generated backend systems- Reviewing public/private witness declarations and assignment flows- Checking Go witness construction and serialization/deserialization boundaries- Reviewing `AssertIsEqual`, selectors, hints, and range assumptions in constraints- Validating curve and field parameter configuration across setup and proving## When NOT to Use- Multi-DSL ZK circuit reviews not centered on gnark — use `zk-circuit-auditor`- Rust `unsafe`, zeroization, or feature-flag issues — use `rust-crypto-safety`- Declaring a suspected gnark issue confirmed without verification gates## Core Review Areas1. Frontend/backend mismatch between `frontend.API` intent and generated constraint system2. Public/private witness binding and accidental data promotion3. Go-side witness assignment and serialization boundaries4. Constraint API misuse (`AssertIsEqual`, selectors, hints, range assumptions)5. Curve/field parameter mismatches and unsafe defaults## Workflow### Phase 1: Frontend/backend trace- Read `references/gnark-checklist.md`- Execute `workflows/frontend-backend-review.md`- Trace each security-critical value from frontend declarations to backend constraints### Phase 2: Assignment and boundary review- Verify public witness declarations match protocol expectations- Review Go witness assignment and error handling before serialization- Check witness decode paths for permissive defaults or silent coercions### Phase 3: Pattern hunt- Read `references/finding-patterns.md`- Prioritize frontend/backend mismatch, witness exposure, and modulus confusion patterns### Phase 4: Handoff- Send surviving findings to `crypto-fp-check`- Use `zkbugs-index` only after the finding survives verification## Output ContractProduce a gnark-specific handoff that includes:- The frontend API declarations and backend constraints involved- The witness visibility or serialization boundary under review- Whether the issue is mismatch, witness exposure, assignment, API misuse, or field-parameter related- The next verification or reporting route## Reference Index- [references/gnark-checklist.md](references/gnark-checklist.md)- [references/finding-patterns.md](references/finding-patterns.md)- [workflows/frontend-backend-review.md](workflows/frontend-backend-review.md)

Frequently asked questions

Gnark Auditor