audit_context_skill

Overview

This skill provides practical guidelines to quickly build context for a smart contract audit before deep vulnerability hunting. It focuses on reconnaissance, system mapping, initial threat modeling, and environment checks so auditors can prioritize effort and scope the review. The result is a compact Audit Context Report that drives testing and deeper analysis.

How this skill works

The skill walks auditors through reconnaissance to locate core logic, documentation, and external interactions. It then guides creation of a system map (roles, assets, state), enumerates entry points, and performs an initial threat model listing attacker profiles and assets at risk. Finally it checks the environment (framework versions, test suite presence) and outputs a structured Audit Context Report to use as a baseline for the audit.

When to use it

• At the start of any smart contract or on-chain component audit
• When onboarding a new codebase to quickly prioritize review effort
• Before writing or running exploit PoCs or fuzzing campaigns
• When deciding audit scope: upgrades, DeFi, or multi-contract systems
• When a rapid triage is needed for bug bounty triage or security reviews

Best practices

• Identify core logic and money flows first (endpoints and payable markers) to prioritize risk
• Map roles, assets, and stored state clearly; document permissions for each endpoint
• List all external contracts and hardcoded addresses; classify interaction types (sync/async/proxy)
• Enumerate all endpoints and check which lack access checks or modifiers
• Run environment checks: framework version, build config, and whether tests exist and are current

Example use cases

• Audit kickoff: produce a concise context report for the security team and stakeholders
• Bug bounty triage: rapidly determine whether a report affects core assets or is out-of-scope
• Red-team planning: identify highest-risk entry points and attacker profiles to craft PoCs
• Regulatory/compliance review: map asset flows and roles to ensure controls are present
• Integration review: assess external dependencies and async call graphs before composing multi-contract systems