skill-yue-zhou1-zkcrypto-audit-crypto-report-writer · by Install
$ agentstack add skill-yue-zhou1-zkcrypto-audit-crypto-report-writer ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-yue-zhou1-zkcrypto-audit-crypto-report-writer) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
crypto-report-writer
Final reporting skill for the crypto audit framework.
When to Use
- A finding has passed
crypto-fp-checkand needs report-ready prose - You need a consistent report section structure across multiple findings
- You are summarizing severity and test evidence for an audit deliverable
- You are drafting disclosed writeups that may later map into
zkbugs-index
When NOT to Use
- The finding is still hypothesis-shaped or missing verification evidence
- You are still building protocol context or running domain-specific review
- You need to decide severity before the evidence is assembled
Workflow
Choose the report variant first, then fill it with verified evidence only:
- [templates/client-report-template.md](templates/client-report-template.md) for client-facing delivery with concise executive and remediation language
- [templates/internal-report-template.md](templates/internal-report-template.md) for engineering/internal circulation with investigation notes and rollout risk
- [templates/public-disclosure-template.md](templates/public-disclosure-template.md) for external publication without private client context
- [templates/report-template.md](templates/report-template.md) for generic/default findings when no specialized variant is required
Do not write around missing proof or test gaps; state them explicitly.
Reference Use
- Use
audit-commonfor shared severity and finding-structure rules - Use
crypto-fp-checkoutput as the source of truth for verified claims - Cite
zkbugs-indexonly when the referenced entry is disclosed and citable
Output Contract
Produce a report-ready finding package that includes:
- Final severity and short title
- Summary, root cause, impact, and remediation
- Test evidence status, including PoC status where required
- Whether the writeup is suitable for external citation or index ingestion
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Yue-Zhou1
- Source: Yue-Zhou1/zkcrypto-audit
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.