auditor-skill plugin
A plugin audits Solana programs and surrounding code against 1,465 items and 141 known attacks and writes a report.
- 64 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- By default it builds and tests the project on your machine, running its build scripts and tests.
- For confirmed findings it builds a runnable exploit, which is dual-use.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/auditor-skillDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- By default it builds and tests the project on your machine, running its build scripts and tests.
- For confirmed findings it builds a runnable exploit, which is dual-use.
This is third-party code. Review the repository files before installing.
What it does
auditor-skill reads code file by file, checks 1,465 items across 20 security domains and tests it against 141 real attack vectors. It gives each finding a severity from 1 to 10 and assembles everything into a structured report. For confirmed High and Critical findings it can build a runnable exploit and a fix proven to stop it. Coverage goes beyond programs: Anchor, native and Pinocchio programs, TypeScript and Rust services, web frontends, Python, Go, Java, Ruby and PHP code, CI workflows, infrastructure and AI components. A branch change review runs with `/auditor:diff-audit` and writes `audit_<n>/PR-REPORT.md`.
Who it is for. Solana developers and project teams who need a first security pass before an external audit.
Good fit when
- Branch changes against `main` are reviewed with `/auditor:diff-audit` before merging.
- A full pass over the repository is run before a mainnet launch.
- A confirmed finding yields a fix verified against the exploit.
- An incident is investigated: the incident commands only describe steps and sign nothing.
Not a fit when
- You need a professional audit opinion with a safety guarantee.
- The code cannot be built and tested on your machine.
- You need social engineering assessment and legal compliance review.
Example request
Review my Solana program branch changes against main with diff-audit and show the findings by severity.Limitations
It is a first pass, not a professional audit: a human auditor is needed before mainnet. By default the plugin builds and tests the project on your machine, which runs the project's own build scripts, procedural macros and tests. For code you do not trust use strict mode with a separate launch line, which also keeps your own plugins out. The resume rules can start a flow by themselves in any repository you open. Incident commands only describe steps and never sign or send transactions.
How to disable. Remove the plugin with a Claude Code command and delete the `audit_<n>/` directories from audited repositories if you no longer need them.
FAQ
How do I install the plugin?
Run `/plugin marketplace add solanabr/auditor-skill` and `/plugin install auditor`.
How do I review only branch changes?
Commit your work, rebase on `main` and run `/auditor:diff-audit`. The report is written to `audit_<n>/PR-REPORT.md` in a run directory ignored by git.
Can it be used without Claude Code?
Yes, it is also a folder of skill files that any LLM agent can follow.
What is strict mode?
Launching Claude Code with separate settings where the plugin keeps your plugins out and limits building untrusted code. The launch line is in the README.
Does it replace a human audit?
No. It gives a first pass and promises no "safe to deploy" verdict.
Discussion
No questions or reviews yet.
Related
PluginsA code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A security audit skill built on OWASP Top 10, CWE and CVSS, with deep PHP and TYPO3 scanning across 80-plus checkpoints.
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
Skill that scans a project for common vibe-coding holes: keys in code, .env in git, open LLM endpoints and weak auth.
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
README in short
The README opens with a warning about limits and splits work by depth: changes, a module or the release. Install is two commands in Claude Code.