web3-audit

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/web3-audit/SKILL.md

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and densely packed with executable grep patterns and code, but it is a monolithic wall of text with no bundle files or reference split, hurting progressive disclosure, and the Operator Notes add ecosystem commentary that slightly dilutes conciseness.

Suggestions

Split the 10 bug-class sections and the Foundry PoC template into separate reference files (e.g. references/bug-classes.md, references/foundry-poc.md) and surface them as one-level-deep links from SKILL.md to improve progressive_disclosure.

Add an explicit validate→fix→retry feedback loop for the Foundry PoC workflow (run test → on revert, fix root cause → re-run) to raise workflow_clarity above the batch/destructive-operation cap.

Trim the Operator Notes ecosystem-commentary prose (tool stack lists, 2024-2026 trend paragraphs) or move it to a separate dated reference, keeping only engagement-derived heuristics inline to improve conciseness.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with concrete code and grep patterns, but the Operator Notes section includes prose explanations of evolving ecosystem context (2024-2026 trends, tooling recommendations) that pad the token budget without directly enabling a finding.	3 / 5
Actionability	Provides copy-paste-ready grep patterns, Solidity VULNERABLE/CORRECT pairs, and a complete Foundry PoC template with cheatcode reference; minor gaps exist where some variants are described rather than given executable form.	4 / 5
Workflow Clarity	The pre-dive kill signals give a clear sequenced decision flow (kill signals → target scoring ≥6/10 → audit), and the Foundry PoC section is well sequenced, though there is no explicit validate→fix→retry checkpoint loop tying PoC failure back to root-cause analysis.	4 / 5
Progressive Disclosure	No references/, scripts/, or assets/ bundle exists and the body is a ~600-line monolith inlining all 10 bug classes, grep patterns, Foundry template, and operator notes; content that clearly belongs in separate files is inlined with no one-level-deep reference structure.	2 / 5
	Total	13 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: third-person voice, explicit 'Use for...' trigger guidance, and a comprehensive enumeration of concrete capabilities. It clearly distinguishes the skill's niche and answers both what and when.

Dimension	Reasoning	Score
Specificity	Enumerates 10 named bug classes (accounting desync, access control, reentrancy, etc.) plus concrete artifacts (Foundry PoC template, grep patterns, Immunefi examples), giving several specific capabilities with only minor gaps in framing discrete actions.	4 / 5
Completeness	Explicitly answers both what ('Smart contract security audit — 10 DeFi bug classes... Foundry PoC template... grep patterns... real Immunefi paid examples') and when ('Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural terms users say ('Smart contract security audit', 'Solidity/Rust contract audit', 'DeFi target', 'Immunefi') with good coverage, though missing a few common synonyms like 'bug bounty' or 'code review'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (DeFi/web3 smart-contract security audit with pre-dive kill signals) with distinct triggers and minimal conflict risk against general-purpose skills.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (606 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/web3-audit/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.