web3-audit

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with executable code, grep patterns, and a Foundry PoC template, but the skill is a long monolithic file with time-sensitive statistics not isolated in a deprecated section and no progressive file-based disclosure despite its size.

Suggestions

Move the per-bug-class deep dives, the Foundry PoC template, and the Operator Notes into reference files (e.g. references/bug-classes.md, scripts/foundry-poc.sol) and keep SKILL.md as a concise overview with one-level-deep links, raising progressive_disclosure.

Quarantine time-sensitive figures and dates (payout percentages, '2024-2026', 'Pectra hard fork 2025', '$953M lost in 2024') into an explicitly labeled 'current landscape / time-sensitive' section so stale stats don't penalize conciseness.

Add a single explicit numbered audit workflow with validation checkpoints (pre-dive gate -> grep sweep -> comparison-test checklist -> PoC with assert -> severity-matrix check) and a validate->fix->retry loop, rather than leaving the sequence implicit across catalog sections.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with abundant executable code, but the ~600-line body carries time-sensitive claims ('28% of all Criticals on Immunefi', '$953M lost in 2024', 'Pectra hard fork 2025', '2024-2026 by bounty') and narrative prose in 'Operator Notes' that is not quarantined in a deprecated/old-patterns section, so it cannot score 3 per the time-sensitive guideline.	2 / 3
Actionability	Provides copy-paste-ready executable Solidity snippets, concrete grep one-liners per bug class, a complete Foundry PoC template, cheatcode reference, and forge commands — matching the 'fully executable, copy-paste ready' anchor.	3 / 3
Workflow Clarity	A clear high-level sequence exists (pre-dive kill signals -> bug-class hunting -> Foundry PoC -> reporting) with some checkpoints (target scoring 'go if >= 6/10', assertGt in the PoC), but the body is organized primarily as a reference catalog with scattered rather than unified validation gates and no explicit validate->fix->retry feedback loop for the audit process.	2 / 3
Progressive Disclosure	Sections are well-organized, but no bundle files (references/, scripts/, assets/) exist and all content — each bug class, the PoC template, and the Operator Notes — is inline in one ~600-line file; the 'content that should be separate is inline' anchor fits and caps this at 2 for a skill this size.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that states concrete capabilities and gives an explicit 'Use for' trigger in third person. It is information-dense rather than padded, though the inline enumeration of all 10 bug-class names leans slightly long.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — '10 DeFi bug classes (accounting desync, access control, ...)', 'pre-dive kill signals (TVL < $500K etc)', 'Foundry PoC template', 'grep patterns for each class', 'real Immunefi paid examples' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers both what (the enumerated capabilities) and when via 'Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.', satisfying the explicit-trigger anchor at level 3.	3 / 3
Trigger Term Quality	Uses natural terms a user would say for this niche — 'Smart contract security audit', 'Solidity/Rust contract audit', 'DeFi target', 'Immunefi', 'Foundry PoC' — with good coverage and common variations, not jargon-only.	3 / 3
Distinctiveness Conflict Risk	A clear niche (DeFi smart-contract security auditing / bounty hunting) with distinct triggers unlikely to fire for unrelated skills; not above 3 as the scale caps there and no overlap risk is present.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (606 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/web3-audit/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.