web3-audit

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable audit catalog with executable code, grep patterns, and a complete Foundry PoC template. Its main weakness is monolithic structure — everything lives in SKILL.md rather than being split into reference files for progressive disclosure.

Suggestions

Move each bug-class section (or the bulkier ones like accounting/access-control/oracle) into per-class reference files under references/ and keep SKILL.md as an overview that links to them, so the full catalog isn't loaded every invocation.

Extract the Foundry PoC template and cheatcode list into scripts/ or references/foundry-poc.md, leaving a short inline stub plus a pointer.

Trim the 'What It Is' prose for bug classes Claude already understands, keeping only the root-cause pattern, the VULNERABLE/CORRECT code, and the grep patterns.

Dimension	Reasoning	Score
Conciseness	Mostly lean — executable code blocks and grep patterns dominate — but a few 'What It Is' prose blocks re-explain concepts (e.g. accounting desync) Claude already knows and could be trimmed.	4 / 5
Actionability	Copy-paste ready VULNERABLE/CORRECT Solidity pairs per bug class, executable grep commands, and a complete Foundry PoC template with cheatcodes and run commands covering the common cases.	5 / 5
Workflow Clarity	Clear sequenced flow — pre-dive kill signals with a numeric go/no-go scoring formula, then per-class review, then a Foundry PoC with an explicit assertGt verification checkpoint — with only minor validation gaps in the broader audit loop.	4 / 5
Progressive Disclosure	Well-organized with clear section headers, but the entire ~545-line catalog is inlined in SKILL.md with no bundle files; the 10 bug classes and PoC template are prime candidates for one-level-deep reference files.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, concrete description that names specific capabilities and gives explicit 'use when' triggers for both auditing and target-selection. Only minor gap is that some natural bounty-hunting terms (Immunefi, bug bounty, web3) are not surfaced as triggers.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — '10 DeFi bug classes', 'pre-dive kill signals (TVL < $500K etc)', 'Foundry PoC template', 'grep patterns for each class', 'real Immunefi paid examples' — with comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what (the enumerated bug classes, kill signals, PoC template, grep patterns, paid examples) and when ('Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting').	5 / 5
Trigger Term Quality	Strong natural keywords ('Smart contract security audit', 'Solidity/Rust contract audit', 'DeFi target'), but common bounty-hunting phrasings like 'bug bounty', 'Immunefi', and 'web3' are absent or only implied rather than surfaced as triggers.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (on-chain smart contract / DeFi security auditing) with distinct triggers and minimal overlap risk against general coding or doc skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (551 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: shuvonsec/claude-bug-bounty
Path: skills/web3-audit/SKILL.md
Commit: 0826b13

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.