Claude Code / agentic security skill for Solana programs and software. Full audit-firm lifecycle, executable PoC + fix-patch delivery, a Rust pre-scanner + cross-audit memory, 1,346 checks across 20 checklists, and 131 real-world attack vectors.
Agent
Deterministic report assembly — aggregates verdicts and findings, builds the Scope Coverage table, severity rollup, maturity scorecard, and remediation roadmap. No code reasoning; keeps report generation cheap.
Agent
Builds architectural understanding before any verdict — runs Phase 0 setup and Phase 0.5 Context Reconstruction, producing the instruction matrix, state model, and per-function worksheets. Spawned first in a full audit.
Agent
Owns checklist 06 (economic & logic) and the economic known-vectors — flash loans, first-depositor, MEV, oracle manipulation, reward accounting. Drives economic simulation to quantify profitability.
Agent
Drafts a minimal idiomatic unified diff that closes exactly the cited bound, then verifies it by re-running the finding's PoC against a scratch worktree — the exploit must now revert. Optional mutation + blast-radius evidence. Emits [FIX-VERIFIED] / [FIX-INSUFFICIENT] / [FIX-PROPOSED]; never claims FIX-VERIFIED…
Agent
Independent reconciliation reviewer — the dual-review second pass. Takes the top-severity confirmed findings and re-derives each one from the code (not from the primary's write-up), reusing the context worksheets to avoid re-reconstruction. Emits CONFIRM / DISPUTE / DOWNGRADE per finding; a DISPUTE forces the finding…
Agent
Given a confirmed finding + its context worksheet, produces the smallest self-contained crate that reproduces the flaw — feature-gated vulnerable/fixed arms, asserting the exploit succeeds on the vulnerable arm and is rejected on the fixed arm. Emits the [PoC-] evidence tier; downgrades to [PoC-ATTEMPTED] + prose on…
Agent
Builds the pre-review threat model before any verdict — asset inventory, actor x capability table, and trust-boundary map — reconstructed from the code and the context worksheets. Drives /auditor:threat-model in a full audit, analogous to how context-builder drives Phase 0.5. No verdicts; attacker-goal enumeration…
Agent
Walks in-scope files item-by-item against the gated checklists and phase-triggered known-vectors, recording an explicit verdict for every item and routing high-severity findings through the Rule 5b validation gate. The core audit worker.