auditor

Plugin auditor from marketplace auditor in solanabr/auditor-skill. Commands read from the repo's manifest — 2 days ago.

Skills (2)

• auditor-skill

  Security auditor for on-chain Solana programs, and full-stack security review in any programming language. USE FOR: auditing Solana/Anchor programs, reviewing smart contract security, checking for vulnerabilities (missing signers, unchecked accounts, arithmetic overflow, CPI attacks, PDA confusion,

• dnr-analyze

  One analysis phase of /auditor:hunt or /auditor:respond, run in the auditor:incident-responder agent over incident_<n>/ only: profiles and queries the incident corpus with the bundled offline tools, keeps LEDGER.md, and writes the incident files there. Invoke it only where those commands say to, wit

Slash commands (17)

• /auditor:audit-assist

  Flow B — AI-assisted iterative audit with a human in the loop. Same lifecycle as audit-cycle, but pauses at checkpoints to surface confirmed findings, the next-focus plan, and targeted questions only the human can answer (business context, trust model, severity calls). The human steers; the agent re

• /auditor:audit-cycle

  Flow A — fully automated audit-firm lifecycle. Runs scope → context → tool-assisted first pass → domain-partitioned manual review → independent reconciliation → client report end-to-end, and delivers a client audit report (MD + optional PDF). Audit-shaped automation, not a substitute for a human fir

• /auditor:audit-report

  Aggregate audit checkpoints into the final report — executive summary, Scope Coverage, findings by severity, maturity scorecard, and remediation roadmap.

• /auditor:audit

  Standard-depth, scope-gated security audit of a Solana / full-stack repository or one path in it — discovery, context reconstruction, per-item checklist verdicts, false-positive validation, and a severity-ranked report.

• /auditor:deep-review

  Deep single-instruction / single-function security review using the instruction worksheet, context reconstruction, and adversarial exploit modeling.

• /auditor:diff-audit

  PR / commit-scoped differential audit — audits only changed functions (plus 1-hop callers) and the published-code delta of changed dependencies, flags removed security checks, and prioritizes by risk × blast radius.

• /auditor:economic-sim

  Quantify a candidate economic finding — compute attack cost vs extractable value and, when possible, reproduce deposit→manipulate→withdraw against a Surfpool mainnet-fork for a real P/L figure.

• /auditor:hunt

  Post-incident threat hunt for when no alert has fired: baseline a Solana program's transaction history and program logs, record each hypothesis and its query in a ledger, check each suspect against the source deployed at the incident slot, replay the attack locally on the real program bytes, and wri

• /auditor:intake

  Interactive engagement intake. Walks QUESTIONS.md and persists the answers to audit_<n>/intake.md — the durable intake artifact both audit-cycle and audit-assist read. Captures scope + commit pin, languages/frameworks, protocol class, compliance, severity calibration, the trust-model inputs that fee

• /auditor:patch

  Draft and verify a fix for a confirmed finding — a MINIMAL idiomatic unified diff against the pinned audited commit, applied to a scratch clone and proven by re-running the finding's PoC (it must now revert). Proposal only; the auditor stays read-only on the client tree. Optional mutation + blast-ra

• /auditor:poc

  Generate an executable proof-of-concept exploit for a confirmed High/Critical finding — detect the toolchain, pick the harness framework by finding type, spawn auditor:poc-engineer, and emit a one-command runnable crate plus the earned [PoC-*] evidence tier. Never hard-fails: on toolchain absence it

• /auditor:quick-scan

  Fast security triage — discovery, static analysis, and the checklist core and vector subset that references/depth-scope.md selects, without the full item-by-item walk. Use for a first look or a CI gate.

• /auditor:re-audit

  Fix-review / re-audit. Takes a prior audit report + the current tree and classifies every prior finding FIXED / PARTIALLY-FIXED / STILL-OPEN / REGRESSED / ACKNOWLEDGED / DISPUTED (re-running Rule 5b on the fix, citing the remediation commit/PR hash), audits the changed surface for NEW findings via t

• /auditor:respond

  Investigate one incident lead (a transaction signature, an address, an alert, an indicator of compromise, or an INC id from /auditor:hunt) through Solana transaction history — work out whether the attack landed and how far it reached, pin the root cause in the deployed code and reproduce it locally,

• /auditor:spec-audit

  Spec-vs-code compliance audit — extracts requirements from a spec / whitepaper / RFC and matches each to the implementation with typed verdicts.

• /auditor:threat-model

  Builds the pre-review threat model as audit_<n>/threat-model.md — an asset inventory (crown-jewel funds/authority/data and where they live), an actor x capability table (each actor → what they can do → what they must NOT be able to do), and a trust-boundary map (which CPIs/accounts/inputs cross a tr

• /auditor:triage

  Re-runnable batch triage checkpoint over the candidate finding set, in one place rather than spread across the agents. Dedups by root-cause signature (reusing /auditor:re-audit's signature idea; audit-mem auto-suppresses prior-ruled false positives and flags regressions when built), enforces Rule 5b

Subagents (9)

• audit-reporter

  Deterministic report assembly — aggregates verdicts and findings, builds the Scope Coverage table, severity rollup, maturity scorecard, and remediation roadmap. No code reasoning; keeps report generation cheap.

• context-builder

  Builds architectural understanding before any verdict — runs Phase 0 setup and Phase 0.5 Context Reconstruction, producing the instruction matrix, state model, and per-function worksheets. Spawned first in a full audit.

• economic-analyst

  Owns checklist 06 (economic & logic) and the economic known-vectors — flash loans, first-depositor, MEV, oracle manipulation, reward accounting. Drives economic simulation to quantify profitability.

• incident-responder

  Does all reading and analysis of the incident corpus for /auditor:hunt and /auditor:respond — profiles a Solana transaction corpus, keeps the hypothesis ledger, scopes a lead, verdicts whether an attack succeeded, quantifies blast radius, and writes incident_<n>/INCIDENTS.json plus the incident repo

• patch-engineer

  Drafts a minimal idiomatic unified diff that closes exactly the cited bound, then verifies it by re-running the finding's PoC against a scratch clone — the exploit must now revert. Optional mutation + blast-radius evidence. Emits [FIX-VERIFIED] / [FIX-INSUFFICIENT] / [FIX-PROPOSED]; never claims FIX

• peer-reviewer

  Independent reconciliation reviewer — the dual-review second pass. Takes the top-severity confirmed findings and re-derives each one from the code (not from the primary's write-up), reusing the context worksheets to avoid re-reconstruction. Emits CONFIRM / DISPUTE / DOWNGRADE per finding; a DISPUTE

• poc-engineer

  Given a confirmed finding + its context worksheet, produces the smallest standalone crate that reproduces the flaw — feature-gated vulnerable/fixed arms, asserting the exploit succeeds on the vulnerable arm and is rejected on the fixed arm. Emits the [PoC-*] evidence tier; downgrades to [PoC-ATTEMPT

• threat-modeler

  Builds the pre-review threat model before any verdict — asset inventory, actor x capability table, and trust-boundary map — reconstructed from the code and the context worksheets, and in bootstrap mode seeded from the collector's history output (git history, fork parent, prior audits, post-mortems,

• vuln-hunter

  Walks in-scope files item-by-item against the gated checklists and phase-triggered known-vectors, recording an explicit verdict for every item and routing high-severity findings through the Rule 5b validation gate. The core audit worker.