Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add forefy/.context --skill smart-contract-auditgit clone --depth 1 https://github.com/forefy/.contextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forefy/.context/smart-contract-audit)<a href="https://agentmods.dev/skills/forefy/.context/smart-contract-audit"><img src="https://agentmods.dev/badge/skills/forefy/.context/smart-contract-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forefy/.context/smart-contract-audit"><img src="https://agentmods.dev/badge/skills/forefy/.context/smart-contract-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.04787 |
| Opus 5 | $0.00028 | $0.02393 |
| Sonnet 5 | $0.00011 | $0.00957 |
| Haiku 4.5 | $0.00006 | $0.00479 |
Grade A, and why
smart-contract-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 363 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smart Contract Security Audit Framework
1. Core Identity and Purpose
You are a senior smart contract security auditor with expert-level knowledge in the field. Your primary goal is to deliver comprehensive security audits through systematic analysis that identifies exploitable vulnerabilities leading to direct fund loss, protocol manipulation, or system compromise.
SKILL DIRECTORY DETECTION:
Before reading any skill resource files, locate this skill's installation directory once and store it as $SKILL_DIR:
SKILL_DIR=$([ -d "$HOME/.context/skills/smart-contract-audit" ] && echo "$HOME/.context/skills/smart-contract-audit" || echo ".context/skills/smart-contract-audit")
Use $SKILL_DIR as the base for all reference and resource file reads. Outputs always go to .context/outputs/ relative to the current project directory.
1.1 Context Preservation Protocol
MANDATORY DEBUG LOGGING:
- Create
.context/outputs/X/audit-debug.mdto log all programmatic tests and decisions - Document every search, scan, and audit trick attempted with brief results
- Log decision points (why certain paths were or weren't pursued)
- Provide technical breadcrumbs for audit reviewers to validate thoroughness
- Do not create any markdown headings or special characters, nothing but a pure straight line should be written as a log
1.2 Workspace and Output Management
IMPORTANT - .context Directory Handling:
- IGNORE ALL FILES in the
.context/directory of the project being audited unless specifically mentioned or referenced by the user - The
.context/folder contains audit framework files and should NOT be included in your security analysis - Only analyze the actual project files outside of
.context/ - EXCEPTION: Use
$SKILL_DIR/reference/for vulnerability pattern lookups
Output Directory Structure: When saving any audit outputs, reports, or analysis files:
- Save to
.context/outputs/directory in numbered folders:.context/outputs/1/,.context/outputs/2/,.context/outputs/3/, etc. - IMPORTANT: Check existing directories first and use the next available number (if
.context/outputs/1/exists, use.context/outputs/2/) - Never overwrite existing audit run directories
- Create the numbered folder structure automatically if it doesn't exist
- Example paths:
.context/outputs/1/audit-report.md,.context/outputs/2/findings.json,.context/outputs/3/threat-model.md
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- anchor-checks.md 7.5 KB
- finding-format.md 5.3 KB
- move-checks.md 12 KB
- multi-expert.md 2.7 KB
- reference/anchor/fv-anc-1-arithmetic-operations/fv-anc-1-cl1-overflow-underflow-in-arithmetic-operations.md 1.5 KB
- reference/anchor/fv-anc-1-arithmetic-operations/fv-anc-1-cl2-division-by-zero.md 1.2 KB
- reference/anchor/fv-anc-1-arithmetic-operations/fv-anc-1-cl3-arbitrary-rounding.md 1.5 KB
- reference/anchor/fv-anc-1-arithmetic-operations/fv-anc-1-cl4-saturating-math-misuse-in-financial-contexts.md 1.7 KB
- reference/anchor/fv-anc-1-arithmetic-operations/fv-anc-1-cl5-round-trip-vault-profit-via-precision-gap.md 2.0 KB
- reference/anchor/fv-anc-1-arithmetic-operations/readme.md 525 B
- reference/anchor/fv-anc-10-closing-accounts/fv-anc-10-cl1-closing-accounts-without-zeroing-data-and-setting-a-closed-discriminator.md 1.5 KB
- reference/anchor/fv-anc-10-closing-accounts/fv-anc-10-cl2-operations-on-accounts-marked-as-closed.md 1.5 KB
- reference/anchor/fv-anc-10-closing-accounts/fv-anc-10-cl3-unintended-closure-by-close-constraint.md 1.5 KB
- reference/anchor/fv-anc-10-closing-accounts/readme.md 494 B
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl1-missing-slippage-tolerance-allowing-extraction.md 1.9 KB
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl2-lamport-balance-invariant-violation-in-cpi.md 2.0 KB
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl3-dust-account-poisoning-blocking-critical-operations.md 1.9 KB
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl4-unbounded-account-collection-causing-dos.md 2.0 KB
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl5-time-unit-mismatch-in-deadline-validation.md 2.0 KB
- reference/anchor/fv-anc-11-state-management/fv-anc-11-cl6-reward-accumulator-updated-after-balance-change.md 2.0 KB
- reference/anchor/fv-anc-11-state-management/readme.md 733 B
- reference/anchor/fv-anc-13-program-management/fv-anc-13-cl1-compute-budget-dos-via-user-injected-limit-instruction.md 2.0 KB
- reference/anchor/fv-anc-13-program-management/fv-anc-13-cl2-uninitialized-vec-capacity-bug.md 1.7 KB
- reference/anchor/fv-anc-13-program-management/fv-anc-13-cl3-upgrade-authority-not-transferred-or-locked.md 1.8 KB
- reference/anchor/fv-anc-13-program-management/fv-anc-13-cl4-log-truncation-hiding-critical-security-events.md 1.9 KB
- reference/anchor/fv-anc-13-program-management/readme.md 576 B
- reference/anchor/fv-anc-2-signer-checks/fv-anc-2-cl1-unvalidated-signers.md 1.3 KB
- reference/anchor/fv-anc-2-signer-checks/fv-anc-2-cl2-no-is_signer-check.md 1.3 KB
- reference/anchor/fv-anc-2-signer-checks/readme.md 308 B
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl1-trying-to-modify-an-account-without-checking-if-its-writeable.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl10-using-ctx.remaining_accounts-without-non-zero-data-check.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl11-no-reload-after-account-mutation.md 1.6 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl12-not-validating-a-set-address.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl13-init-if-needed-without-reinit-guard.md 1.7 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl14-realloc-without-zero-init.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl2-trying-to-access-account-data-without-ownership-checks.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl3-usage-of-uncheckedaccount-without-manual-ownership-check.md 1.5 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl4-usage-of-uncheckedaccount-without-manual-signer-check.md 1.3 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl5-no-is_initialized-check-when-operating-on-an-account.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl6-missing-account-constraints.md 1.5 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl7-duplicate-mutable-accounts.md 1.3 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl8-using-ctx.remaining_accounts-without-manual-ownership-check.md 1.4 KB
- reference/anchor/fv-anc-3-account-ownership-validations/fv-anc-3-cl9-using-ctx.remaining_accounts-without-manual-discriminator-check.md 1.5 KB
- reference/anchor/fv-anc-3-account-ownership-validations/readme.md 1.2 KB
- reference/anchor/fv-anc-4-pda-security/fv-anc-4-cl1-using-create_program_address.md 1.5 KB
- reference/anchor/fv-anc-4-pda-security/fv-anc-4-cl2-pda-seed-concatenation-collision.md 1.4 KB
- reference/anchor/fv-anc-4-pda-security/fv-anc-4-cl3-pda-sharing-single-global-vault.md 1.3 KB
- reference/anchor/fv-anc-4-pda-security/fv-anc-4-cl4-pda-purpose-isolation-failure.md 1.9 KB
- reference/anchor/fv-anc-4-pda-security/fv-anc-4-cl5-pda-signer-without-ownership-verification.md 1.9 KB
- reference/anchor/fv-anc-4-pda-security/readme.md 491 B
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl1-lack-of-validation-of-external-program-before-cpi.md 1.4 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl10-cross-program-reentrancy-via-callback.md 2.0 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl11-cpi-to-upgradeable-program-without-version-pin.md 1.7 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl2-cpi-without-signer-seeds.md 1.4 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl3-not-unsetting-signer-status-before-a-cpi.md 1.4 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl4-passing-unnecessary-accounts-to-cpis.md 1.3 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl5-sol-balance-drain-via-cpi.md 1.4 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl6-post-cpi-ownership-change.md 1.5 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl7-invoke-signed-with-wrong-or-partial-seeds.md 1.8 KB
- reference/anchor/fv-anc-5-cross-program-invocation-cpi/fv-anc-5-cl8-cpi-to-system-program-creates-unintended-account.md 1.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 363 lines · 55 tokens per session scan A c2aeb2c264ed
smart-contract-audit is a skill published in the GitHub repository forefy/.context (144 stars, last pushed 2d ago), licensed MIT. It adds 55 tokens to every session and 4,787 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for…
meme-coin-audit
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP…
authoring-godot-prompter-skills
Use when writing or editing a SKILL.md or an agent definition in this repo — required frontmatter, section ordering, and the GDScript-then-C# example convention.
hr-blockchain
Help HR and recruiting teams hire and screen blockchain and Web3 engineering candidates (smart contracts, protocol engineering, cryptography). Use when asked to write a blockchain engineer job description, create smart contract interview questions, assess a Web3 candidate, build a blockchain role leveling framework…
defi-trading-systems
Designs DeFi trading systems for perpetual futures, liquidity provision, and automated strategies with risk management and MEV protection.
clawild-moltbook
Use when autonomous crypto intelligence agent for Moltbook — blockchain analysis, social sentiment tracking, and real-time alpha detection. Use when working with clawild moltbook.