web3-audit

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and token-efficient, with executable code, grep patterns, and a complete Foundry PoC template. Its main weaknesses are the lack of an end-to-end audited workflow with feedback checkpoints and a monolithic single-file structure that forgoes progressive disclosure.

Suggestions

Add a short end-to-end audit workflow section (target triage → sibling-function review per 'The One Rule' → run grep patterns → write Foundry PoC → verify) with explicit go/no-go checkpoints to lift workflow clarity.

Split the Foundry PoC template and per-bug-class detail into one-level-deep reference files (e.g., references/foundry-poc.md, references/bug-classes.md) referenced from a concise overview in SKILL.md to apply progressive disclosure.

Consider grouping the repeated grep-pattern blocks into a single references/grep-patterns.md and linking from each class to reduce duplication and body length.

Dimension	Reasoning	Score
Conciseness	The body is dense reference material — compact code snippets, grep one-liners, and terse prose — that assumes Claude's Solidity competence and does not pad with explanations of basic concepts, matching the lean score-3 anchor.	3 / 3
Actionability	Provides executable vulnerable/correct Solidity pairs, runnable grep patterns, a complete copy-paste Foundry PoC template with cheatcode reference, and concrete forge commands, satisfying the fully-executable score-3 anchor.	3 / 3
Workflow Clarity	Useful sub-workflows exist (pre-dive go/no-go scoring, the function-family comparison test, and the Foundry verify step), but the dominant structure is a catalog of bug classes rather than a cohesive end-to-end audit sequence with explicit validation checkpoints and feedback loops.	2 / 3
Progressive Disclosure	The skill is a ~550-line monolithic single file with no bundle references; section headers provide good navigation, but content that could be split (e.g., the Foundry template, per-class detail) is all inline, fitting the score-2 anchor of structure present but content that should be separate kept inline.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and complete, naming concrete deliverables and an explicit Use-for clause with minimal fluff. It uses the recommended third-person/imperative voice and is highly distinct from other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Smart contract security audit", "pre-dive kill signals (TVL < $500K etc)", "Foundry PoC template", "grep patterns for each class", and "real Immunefi paid examples" — matching the score-3 anchor that lists several specific concrete actions.	3 / 3
Completeness	Clearly answers both what (the 10 bug classes, kill signals, PoC template, grep patterns, examples) and when via the explicit "Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting" clause, satisfying the score-3 anchor.	3 / 3
Trigger Term Quality	Covers natural terms a user would say — "Solidity/Rust contract audit", "DeFi target is worth hunting", "Immunefi" — alongside the domain vocabulary, giving good coverage of trigger phrases rather than jargon-only.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche — web3/DeFi smart-contract security auditing — with distinct, specialized triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (551 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: shuvonsec/claude-bug-bounty
Path: skills/web3-audit/SKILL.md
Commit: 2009594

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.