Audit
- 16 installs
- 244 repo stars
- Updated July 21, 2026
- austintgriffith/ethskills
audit is a Claude skill that runs a deep EVM smart-contract security audit using parallel specialist checklist agents and files GitHub issues for findings.
About
This skill is a deep EVM smart-contract security audit system for contracts you did not write. A developer uses it to systematically find vulnerabilities by running parallel specialist agents against domain-specific checklists, then synthesizing findings and filing GitHub issues. It selects 5 to 8 checklists via a routing table based on contract type and files issues for Medium severity and above.
- Deep EVM smart-contract security audit across 19 vulnerability domains via parallel sub-agents
- Routes 20 specialist checklists (ERC20, AMM, lending, proxies, oracles, flashloans, and more)
- Synthesizes findings into an audit report and files GitHub issues for Medium severity and above
Audit by the numbers
- 16 all-time installs (skills.sh)
- Ranked #1,608 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 4, 2026 (Skillselion catalog sync)
audit capabilities & compatibility
- Capabilities
- security audit · smart contract audit · vulnerability scanning
- Works with
- github
- Use cases
- security audit · code review
What audit says it does
A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues.
Covers 500+ non-obvious checklist items across 19 domains via parallel sub-agents.
npx skills add https://github.com/austintgriffith/ethskills --skill auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 16 |
|---|---|
| repo stars | ★ 244 |
| Last updated | July 21, 2026 |
| Repository | austintgriffith/ethskills ↗ |
What it does
Systematically audit an EVM smart contract for vulnerabilities using parallel checklist agents and file GitHub issues.
Who is it for?
developers auditing EVM smart contracts they did not write for security vulnerabilities
Skip if: teaching defensive coding, which the skill says the separate security skill covers
When should I use this skill?
the user asks to audit a contract, find vulnerabilities, or file security issues on a contract repo
What you get
A synthesized audit report and filed GitHub issues covering confirmed vulnerabilities across the relevant security domains.
- per-domain findings files
- a synthesized AUDIT-REPORT.md
- filed GitHub issues for Medium+ severity
By the numbers
- 500+ checklist items across 19 domains
- 20 specialist checklist skills
- selects 5-8 skills per audit
Files
EVM Smart Contract Audit
A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues.
The Checklists
20 specialized skills covering every major vulnerability domain. Fetch the master index first:
https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.mdThe master index contains:
- Full routing table (which skills to load for which contract types)
- The complete audit methodology (recon → parallel agents → synthesis → issues)
- Standard finding format with severity definitions
All 20 skill checklists are at:
https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/<skill-name>/references/checklist.mdSkills Available
| Skill | When to Load |
|---|---|
evm-audit-general | Always |
evm-audit-precision-math | Always |
evm-audit-erc20 | Contract interacts with ERC20 tokens |
evm-audit-defi-amm | AMM, DEX, Uniswap V3/V4, liquidity pools |
evm-audit-defi-lending | Lending, borrowing, CDP, liquidations |
evm-audit-defi-staking | Staking, liquid staking, restaking, EigenLayer |
evm-audit-erc4626 | Vaults, share/asset conversion |
evm-audit-erc4337 | Account abstraction, paymasters, session keys |
evm-audit-bridges | Cross-chain, LayerZero, CCIP, Wormhole |
evm-audit-proxies | Upgradeable contracts, UUPS, Transparent, Diamond |
evm-audit-signatures | Off-chain signatures, EIP-712, permits |
evm-audit-governance | DAO voting, timelocks, multi-sig |
evm-audit-oracles | Chainlink, TWAP, Pyth, price feeds |
evm-audit-assembly | Inline assembly, Yul, CREATE2 |
evm-audit-chain-specific | Non-mainnet: Arbitrum, OP, zkSync, Blast, BSC |
evm-audit-flashloans | Flash loan attack vectors |
evm-audit-erc721 | NFTs, ERC721, ERC1155 |
evm-audit-dos | DoS, unbounded loops, gas griefing |
evm-audit-access-control | Ownership, roles, centralization risks |
How To Run An Audit
1. Fetch the master skill (link above) — it has the full pipeline 2. Read the contract(s) 3. Select 5-8 skills using the routing table 4. Spawn one opus sub-agent per skill (parallel) 5. Each agent walks its checklist and writes findings-<skill>.md 6. Synthesize all findings into AUDIT-REPORT.md 7. File GitHub issues for Medium severity and above
Invocation
Audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/Foo.sol
Checklists: https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.mdSources
Built from research by Dacian, beirao.xyz, Sigma Prime, RareSkills, Decurity, weird-erc20, Spearbit, Hacken, OpenZeppelin, Cyfrin, and more. Full attribution: https://github.com/austintgriffith/evm-audit-skills#attribution--thanks
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
How does the audit run?
It selects 5-8 checklists via a routing table, spawns one opus sub-agent per checklist in parallel, then synthesizes findings into an audit report.
What findings get filed as issues?
GitHub issues are filed for Medium severity and above after synthesis.