skill-yue-zhou1-zkcrypto-audit-fiat-shamir-auditor · by Install
$ agentstack add skill-yue-zhou1-zkcrypto-audit-fiat-shamir-auditor ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-yue-zhou1-zkcrypto-audit-fiat-shamir-auditor) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
fiat-shamir-auditor
Domain auditor for transcript-binding and challenge-derivation correctness.
When to Use
- Reviewing Fiat-Shamir transforms in proof systems and signature schemes
- Auditing transcript absorb order and challenge derivation timing
- Checking public input and domain separation binding to transcript state
- Reviewing multi-round challenge dependencies in non-interactive protocols
When NOT to Use
- Hash primitive internals when transcript behavior is not under review
- Generic circuit checks with no transcript/challenge path
- Marking suspected transcript flaws as confirmed without verification gates
Core Review Areas
- Transcript completeness for all prover and context messages
- Domain separation across protocol rounds and contexts
- Challenge derivation order and dependency correctness
- Public input and statement binding to challenges
- Multi-round transcript consistency and reset safety
- Hash primitive suitability for challenge derivation
Workflow
Phase 1: Transcript inventory
- Read
references/fiat-shamir-checklist.md - Identify all absorb/squeeze operations and transcript states
- Enumerate every statement element expected to influence challenges
Phase 2: Binding review
- Execute
workflows/transcript-binding-review.md - Verify commitments are absorbed before challenge derivation
- Ensure public inputs and domain labels are bound at correct points
Phase 3: Pattern hunt
- Read
references/finding-patterns.md - Prioritize frozen-heart style independence, missing absorbs, and reset bugs
Phase 4: Handoff
- Send surviving findings to
crypto-fp-check - Use
zkbugs-indexonly after verification succeeds
Output Contract
Produce a transcript-audit handoff that includes:
- The transcript states, labels, and challenge points involved
- The exact missing binding, absorb-order, or reset-safety issue
- Whether the issue affects soundness, replay resistance, or protocol context separation
- The next verification or reporting route
Reference Index
- [references/fiat-shamir-checklist.md](references/fiat-shamir-checklist.md)
- [references/finding-patterns.md](references/finding-patterns.md)
- [workflows/transcript-binding-review.md](workflows/transcript-binding-review.md)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Yue-Zhou1
- Source: Yue-Zhou1/zkcrypto-audit
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.