Researches security considerations for standards, protocols, and specifications (e.g. ERC-4337, Move object model, StarkNet messaging, OAuth 2.0, JWT, gRPC). Use after the MAP phase identifies relevant standards, or when the user asks for a security checklist for a specific standard or protocol.
Free-form security analysis of a code cluster. Spawned during SCAN phase for broad cluster exploration. Receives full source, structural context, and trust assumptions. Returns findings, refutations, backlog items, and storage handoff points.
Targeted investigation of a specific security hypothesis. Spawned during SCAN phase when the auditor wants a falsifiable question answered. Receives relevant source clusters, structural context, and trust assumptions. Returns confirmed finding or specific refutation.
Systematic check of a specific risk pattern against a codebase. Spawned during SWEEP phase for coverage of patterns not addressed in SCAN. Receives the pattern description, relevant source files, and trust assumptions. Reports whether the pattern applies to each component.
Mechanical value tracing through storage handoff points. Spawned during SCAN when the auditor wants concrete verification of a writer/reader pair. Receives ONLY the two function sources and concrete input values — no SCAN findings, no safety conclusions. Reports what values end up where.
Provides the `aud` CLI binary used by all other auditor-addon skills (estimator, security-auditor, threat-modeling, sast-pipeline, rule-authoring). Load this skill whenever any `aud` command needs to be invoked. The binary is at `<SKILL_DIR>/bin/aud` — use the `bin/aud` dispatcher which auto-selects the correct platform binary.
Evaluate high-level protocol or system designs for overcomplication, then propose simpler, more structured alternatives with explicit trade-offs. Use when the user wants to challenge a system design, simplify an architecture, reduce protocol complexity, or compare design alternatives.
Conducting project scoping and estimation using logical chunking and metric analysis. Use when the user wants to estimate audit effort, scope a codebase for review, calculate hours for a security engagement, or assess the size of a diff or full repository.
Writing SAiST static analysis rules in Lua — both shipped rules in the auditor-addon repo and custom per-engagement rules in audit workspaces. Use when the user wants to create a new detection rule, add a security check, implement a code smell detector, turn a confirmed finding into a reusable rule, or extend the rule set. Covers rule types (scope/deep/map), the Lua API, language scoping, finding kinds, custom rules, and testing patterns.
Running the SAiST (Static AI-assisted Security Testing) pipeline against a codebase. Use when the user wants to run static analysis rules, detect code smells, find vulnerability patterns, or scan code with the built-in rule engine. Covers the full gaps → resolve → run flow using the `aud` CLI.
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Skills and a CLI for code estimation, security auditing, and professional report writing. Works with any AI coding environment.
Skills are structured workflows that guide the AI through multi-step processes. Each skill contains detailed instructions, phases, and best practices for specific tasks.
| Skill | Purpose | Capabilities |
|---|---|---|
| 🛡️ security-auditor | Interactive security auditing with Map & Probe methodology | Map (structural inventory) → Checklist (optional, standard-specific) → Probe (per-path vulnerability analysis) |
| 🔍 threat-modeling | Systematic threat enumeration before code-level auditing | Analyze → Diagram → Attackers → Assets → Threats (STRIDE) → Report |
| 📊 estimator | Project scoping and effort estimation | Full scope (Discovery, Explore, Metrics, Report) or Diff scope (Discovery, Review, Report) |
| 🧠 design-challenger | Challenge overcomplicated designs | Propose simplifications with explicit trade-offs |
| 📝 scribe | Report writing and finding generation | Professional issue descriptions, report introductions |
| 🔬 sast-pipeline | Run the SAiST static analysis pipeline | Init scan → Resolve gaps → Run rules (shipped + custom) |
| ✏️ rule-authoring | Author SAiST detection rules | Scope, deep, and map rule types with testing patterns |
Skills provide complete workflows that the AI follows autonomously. When invoked, the AI loads the skill's protocol and executes it step-by-step, using the available tools as needed. Each skill can be invoked through its respective slash command (e.g., /security-auditor, /estimator).
[!NOTE] Model Performance: Skills perform differently across AI models. Depending on your needs, you may want to adjust the model for optimal results:
- Speed: Lighter models (e.g., Claude Haiku, Gemini Flash) execute faster but may miss subtle issues
- Reasoning Effort: More capable models (e.g., Claude Sonnet/Opus, Gemini Pro) provide deeper analysis and better edge case detection
- Thoroughness: Higher-tier models tend to be more comprehensive in their exploration and validation
- Verbosity: Models with higher reasoning capabilities can be less verbose in their thinking process
Experiment with different models to find the right balance for your use case.
The aud CLI provides structured code analysis through tree-sitter AST parsing. All commands support glob patterns for analyzing multiple files at once (e.g., "src/**/*.sol"). Skills invoke these commands automatically as part of their workflows. Output uses TOON by default; pass --json for JSON.
aud peekExtracts function and method signatures from source files without reading full implementations. The estimator skill uses peek to quickly understand a codebase's API surface, what functions exist, their parameters, visibility, and modifiers. This is ideal for initial exploration and building a mental map of unfamiliar code, without the need to read full files.
aud metricsCalculates code metrics:
The estimator skill uses this command to calculate how long it takes to perform a security audit.
aud diff-metricsnpx claudepluginhub artifex1/auditor-addon --plugin auditor-addonAWOS code quality audit framework
Analyze local repos for code health, complexity, test coverage gaps - multi-dimensional health analysis combining complexity + churn + coverage
Live codebase visualization and structural quality gate — 14 health dimensions graded A-F, dependency analysis, and architecture governance via MCP
Personal Claude Code + Codex dev stack: security hooks, AI-first code conventions, /security-review, /repo-map, /stack-check, portable statusline. Designed to complement other skills-based plugins, not replace them.
Automated code review with severity levels and actionable feedback
Codebase vital signs — hotspot detection, ROI-ranked diagnosis, co-change coupling, knowledge risk, and AI provenance tracking