Audit

Audit

Orchestrated security audit. Creates a team and spawns teammates across 5 waves to run 20 specialized audit skills against a Solidity codebase. Each teammate invokes one skill via Skill tool and writes findings to .audit-work/.

Input

• $ARGUMENTS — Project root path (optional, defaults to cwd)

Excluded

sc-auditor-security has interactive USER GATES — run it separately via /sc-auditor-security .

Execution

Step 1: Validate Target

find ${TARGET:-.} -name "*.sol" -not -path "*/node_modules/*" -not -path "*/lib/*" | head -5

If no .sol files found, stop and tell the user. Set $TARGET to resolved path.

mkdir -p .audit-work

Step 2: Create Team and Tasks

TeamCreate(team_name="audit", description="Parallel security audit across 20 skills")

Create ALL 20 tasks upfront:

TaskCreate(subject="entry-point-analyzer", description="Map state-changing entry points by access level")
TaskCreate(subject="audit-prep-assistant", description="Pre-audit codebase preparation and documentation")
TaskCreate(subject="audit-context-building", description="Ultra-granular line-by-line code context")
TaskCreate(subject="audit-lending", description="Lending/borrowing protocol vulnerabilities")
TaskCreate(subject="audit-reentrancy", description="Reentrancy attack vectors")
TaskCreate(subject="audit-math-precision", description="Arithmetic precision and rounding errors")
TaskCreate(subject="audit-oracle", description="Oracle integration vulnerabilities")
TaskCreate(subject="audit-signature", description="Signature replay and malleability")
TaskCreate(subject="audit-staking", description="Staking/reward protocol vulnerabilities")
TaskCreate(subject="audit-state-validation", description="State validation and access control")
TaskCreate(subject="audit-slippage", description="DEX slippage and sandwich attacks")
TaskCreate(subject="audit-liquidation", description="Liquidation incentive structure")
TaskCreate(subject="audit-auction", description="Auction mechanism manipulation")
TaskCreate(subject="audit-liquidation-dos", description="Liquidation denial of service")
TaskCreate(subject="audit-liquidation-calculation", description="Liquidation calculation errors")
TaskCreate(subject="audit-unfair-liquidation", description="Unfair liquidation timing")
TaskCreate(subject="audit-clm", description="Concentrated liquidity manager issues")
TaskCreate(subject="pashov-solidity-auditor", description="Parallel vector-scan security audit")
TaskCreate(subject="token-integration-analyzer", description="Token conformity and weird ERC20 patterns")
TaskCreate(subject="guidelines-advisor", description="Trail of Bits best practices assessment")

Step 3: Wave 1 — Recon

Spawn 3 teammates in a single message:

Task(
  name="w1-entry-points",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-entry-points on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"entry-point-analyzer\" (owner=\"w1-entry-points\", status=\"in_progress\")
2. mkdir -p .audit-work/entry-point-analyzer
3. Use the Skill tool: skill=\"entry-point-analyzer\", args=\"$TARGET\"
4. Write the skill output to .audit-work/entry-point-analyzer/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary of entry point counts"
)

Task(
  name="w1-audit-prep",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-audit-prep on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"audit-prep-assistant\" (owner=\"w1-audit-prep\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-prep-assistant
3. Use the Skill tool: skill=\"audit-prep-assistant\"
   The skill prepares the codebase for security review.
4. Write the skill output to .audit-work/audit-prep-assistant/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary"
)

Task(
  name="w1-context",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-context on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"audit-context-building\" (owner=\"w1-context\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-context-building
3. Use the Skill tool: skill=\"audit-context-building\"
   The skill builds deep architectural context via line-by-line analysis.
4. Write the skill output to .audit-work/audit-context-building/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary of context discovered"
)

Wait for all 3 to complete. Verify via TaskList.

Step 4: Wave 2 — Domain Scans A

Spawn 5 teammates in a single message:

Task(
  name="w2-lending",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-lending on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-lending\" (owner=\"w2-lending\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-lending
3. Use the Skill tool: skill=\"audit-lending\"
4. Write findings to .audit-work/audit-lending/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-reentrancy",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-reentrancy on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-reentrancy\" (owner=\"w2-reentrancy\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-reentrancy
3. Use the Skill tool: skill=\"audit-reentrancy\"
4. Write findings to .audit-work/audit-reentrancy/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-math",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-math on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-math-precision\" (owner=\"w2-math\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-math-precision
3. Use the Skill tool: skill=\"audit-math-precision\"
4. Write findings to .audit-work/audit-math-precision/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-oracle",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-oracle on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-oracle\" (owner=\"w2-oracle\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-oracle
3. Use the Skill tool: skill=\"audit-oracle\"
4. Write findings to .audit-work/audit-oracle/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-signature",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-signature on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-signature\" (owner=\"w2-signature\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-signature
3. Use the Skill tool: skill=\"audit-signature\"
4. Write findings to .audit-work/audit-signature/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Wait for all 5. Verify via TaskList.

Step 5: Wave 3 — Domain Scans B

Spawn 5 teammates in a single message:

| Name | Skill | Task subject | |------|-------|-------------| | w3-staking | audit-staking | audit-staking | | w3-state | audit-state-validation | audit-state-validation | | w3-slippage | audit-slippage | audit-slippage | | w3-liquidation | audit-liquidation | audit-liquidation | | w3-auction | audit-auction | audit-auction |

Use the same prompt template as Wave 2 — substitute skill name, teammate name, and task subject.

Wait for all 5. Verify via TaskList.

Step 6: Wave 4 — Domain Scans C

Spawn 5 teammates in a single message:

| Name | Skill | Task subject | |------|-------|-------------| | w4-liq-dos | audit-liquidation-dos | audit-liquidation-dos | | w4-liq-calc | audit-liquidation-calculation | audit-liquidation-calculation | | w4-unfair-liq | audit-unfair-liquidation | audit-unfair-liquidation | | w4-clm | audit-clm | audit-clm | | w4-pashov | pashov-solidity-auditor | pashov-solidity-auditor |

Same prompt template. Wait for all 5. Verify via TaskList.

Step 7: Wave 5 — Deep Analysis

Spawn 2 teammates in a single message:

| Name | Skill | Task subject | |------|-------|-------------| | w5-token | token-integration-analyzer | token-integration-analyzer | | w5-guidelines | guidelines-advisor | guidelines-advisor |

Same prompt template. Wait for both. Verify via TaskList.

Step 8: Synthesize Report

Read all findings:

ls .audit-work/*/FINDINGS.md

Read each FINDINGS.md. Write .audit-work/REPORT.md:

# Security Audit Report

**Target:** $TARGET
**Date:** $(date)
**Skills executed:** 20

## Executive Summary

[2-3 sentences: total findings, severity breakdown, most critical areas]

## Findings by Severity

### Critical
[Deduplicated findings rated Critical/High across all skills]
- **Source:** skill name | **File:** path:line | **Issue:** description | **Fix:** remediation

### High
[...]

### Medium
[...]

### Low / Informational
[...]

## Coverage Matrix

| Skill | Status | Findings | Critical | High | Medium | Low |
|-------|--------|----------|----------|------|--------|-----|
| entry-point-analyzer | ✓/✗ | N | ... |
| audit-lending | ✓/✗ | N | ... |
| ... |

## Recon Summary

### Entry Points
[From w1-entry-points]

### Architectural Context
[From w1-context]

## Next Steps

- [ ] Run `/sc-auditor-security $TARGET` for interactive deep audit with proof generation
- [ ] Address Critical findings immediately
- [ ] Review High findings for exploitability

Step 9: Shutdown

SendMessage(type="shutdown_request", recipient="broadcast", content="Audit complete. Shutting down.")
TeamDelete(team_name="audit")

Tell the user:

1. Report location: .audit-work/REPORT.md
2. Individual findings: .audit-work//FINDINGS.md
3. Suggest: /sc-auditor-security $TARGET for interactive deep audit

Teammate Prompt Template

All teammates use this template (substitute $NAME, $SKILL, $TASK_SUBJECT):

You are audit teammate $NAME on team "audit".

TARGET: $TARGET

1. TaskUpdate: claim task "$TASK_SUBJECT" (owner="$NAME", status="in_progress")
2. mkdir -p .audit-work/$SKILL
3. Use the Skill tool: skill="$SKILL"
4. Write findings to .audit-work/$SKILL/FINDINGS.md
5. TaskUpdate: complete (status="completed")
6. SendMessage to team lead: findings count + severity summary

Execution Rules

1. All teammates use Skill tool — never inline skill work (SkillFlattening anti-pattern)
2. Spawn all wave teammates in a single message — true parallel execution
3. Max 5 teammates per wave — per CLAUDE.md constraint
4. Wait between waves — TaskList before launching next wave
5. Use Task tool with team_name — standalone Agent() cannot call skills
6. Shutdown before TeamDelete — send shutdown_request, wait for confirmations
7. Deduplicate findings — multiple skills may flag the same root cause
8. Severity normalization — map each skill's scale to Critical/High/Medium/Low

Skill Relevance

Not all skills produce findings on every codebase. If a skill finds nothing (e.g., audit-lending on a non-lending protocol), the teammate writes "No relevant patterns found" to FINDINGS.md and completes the task.

Examples

# Audit current directory
/orc:audit

# Audit specific project
/orc:audit ~/git/my-defi-protocol

# Audit subdirectory
/orc:audit src/contracts/

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: qGolem
• Source: qGolem/orc
• License: MIT

Install and usage instructions live in the source repository linked above.