Security & Auditing Skills

Onbard yourself to this repo that might have X number of other agents running on it. Whenever you are starting off or asked to onboard to team use this skill to give yourself extra awareness of multi-agent and worker context, as well as goals and identity.

Generate a security audit scope document from one or more GitHub repo URLs and/or API access descriptions. Outputs a 3-line protocol narrative (mission, user story, attacker story) followed by a scope table with NSLOC, focus areas, and days. Use when scoping a new audit engagement.

Generate and administer interactive knowledge quizzes for security auditors based on repository documentation and code. Use when an auditor needs to be tested on their understanding of a codebase, protocol mechanics, security considerations, potential vulnerabilities, or core functionality. Triggers include requests like "quiz me on", "test my knowledge", "generate a quiz", or when preparing for security audits and code reviews.

Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology: threat recognition, incident scoping, data collection, transaction tracking, chain analysis, attribution, OSINT, advanced demixing, cross-chain tracing, graph clustering, and reporting. Guides users through investigations via targeted questions. Free and open-source tools are preferred and instructed at point of need. Paid tools are acknowledged but not required. Use when investigating hacks, stolen funds, laundering routes, wallet attribution, or crypto fraud.

Takes the active conversation as reference to understand how a skill can be created, with all the lessons learned from the users need in the conversation.

Live endpoint threat hunting skill. Systematically scans a system for malicious activity across all categories (Process, File, Network, Persistence, User Account, Registry, etc.) using only native OS tools. Covers macOS, Linux, and Windows at T1 (no privs) and T2 (sudo/admin) levels. Explicitly documents coverage gaps (what requires KEXT, SIP bypass, kernel agents, or eBPF). Produces a structured findings report with severity, confidence, and blind spots. Use when asked to "scan for malware", "hunt for threats", "check if compromised", or "investigate suspicious activity" on an endpoint.

Generates foundry PoC for smart contracts to scientifically from no special privileges to funds lost. Focused on proof of concept for EVM using forge test.

Expert skill for creating, formatting, and maintaining security audit reports in Google Docs via the Docs API. Use when asked to write, update, style, or fix an audit report document - including finding formatting, summary tables, inline code styling, bullet conversion, cross-reference hyperlinks, and severity color schemes. Covers auth, index-drift safety, and all common formatting pitfalls.

Comprehensive infrastructure security audit framework for IaC, Docker, Kubernetes, and cloud configurations. Use for full infrastructure audits.

Sweeps DeFi protocol Safe multisig wallets for governance misconfigurations and security weaknesses. Given a protocol name, Safe address, or "sweep all", fetches live config and tx history from the Safe Transaction Service API, scores each Safe against a finding pattern library, and produces an audit-ready ranked report. Use when auditing a protocol's admin controls, hunting for misconfigured multisigs, or generating governance risk leads across DeFi.

Wrap the current audit agent session inside the Anthropic Sandbox Runtime (srt) before starting any security audit. Use this before invoking smart-contract-audit, infrastructure-audit, or any other audit skill on an untrusted codebase. Triggers include: start a sandboxed audit, run audit in sandbox, sandbox before auditing, protect my session during audit.