OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add trailofbits/skills --skill audit-prep-assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.
npx skills add trailofbits/skills --skill audit-prep-assistant
Helps prepare for a security review using Trail of Bits' checklist. A well-prepared codebase makes the review process smoother and more effective.
Use this: 1-2 weeks before your security audit
Helps define what you want from the review:
Key Questions:
Documents goals to share with the assessment team.
Runs static analysis and helps fix low-hanging fruit:
Run Static Analysis:
For Solidity:
For Rust:
For Go:
For Go/Rust/C++:
Then I'll:
Increase Test Coverage:
Remove Dead Code:
Goal: Clean static analysis report, high test coverage, minimal dead code
Helps make code clear and accessible:
Provide Detailed File List:
Create Build Instructions:
Freeze Stable Version:
Identify Boilerplate:
Helps create documentation:
Flowcharts and Sequence Diagrams:
User Stories:
On-chain/Off-chain Assumptions:
Actors and Privileges:
External Developer Docs:
Function Documentation:
Glossary:
Video Walkthroughs (optional):
When invoked, I will:
Adapts based on:
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "README covers setup, no need for detailed build instructions" | READMEs assume context auditors don't have | Test build on fresh environment, document every dependency version |
| "Static analysis already ran, no need to run again" | Codebase changed since last run | Execute static analysis tools, generate fresh report |
| "Test coverage looks decent" | "Looks decent" isn't measured coverage | Run coverage tools, identify specific untested code paths |
| "Not much dead code to worry about" | Dead code hides during manual review | Use automated detection tools to find unused functions/variables |
| "Architecture is straightforward, no diagrams needed" | Text descriptions miss visual patterns | Generate actual flowcharts and sequence diagrams |
| "Can freeze version right before audit" | Last-minute freezing creates rushed handoff | Identify and document commit hash now, create dedicated branch |
| "Terms are self-explanatory" | Domain knowledge isn't universal | Create comprehensive glossary with all domain-specific terms |
| "I'll do this step later" | Steps build on each other - skipping creates gaps | Complete all 4 steps sequentially, track progress with checklist |
When I finish helping you prepare, you'll have concrete deliverables like:
Verification: ✓ Build succeeds without errors ✓ All 127 tests pass ✓ No warnings from compiler
Generated Artifacts: ✓ ARCHITECTURE.md - System overview with diagrams ✓ USER_STORIES.md - 12 user interaction flows ✓ GLOSSARY.md - 34 domain terms defined ✓ docs/diagrams/contract-interactions.png ✓ docs/diagrams/swap-flow.png ✓ docs/diagrams/state-machine.png
NatSpec Coverage: 100% of public functions
Network: Ethereum Mainnet Commit: abc123def456 (audit-march-2024 branch) Deployed Contracts:
PACKAGE READY FOR AUDIT ✓ Next Step: Share with Trail of Bits assessment team