Which programming languages and tools are supported?

The skill supports Solidity (Slither), Rust (Dylint), Go (golangci-lint), and C++, and can also integrate with CodeQL and Semgrep checks.

When is the best time to use the Audit Prep Assistant?

It is ideally used 1 to 2 weeks before your scheduled security audit to ensure you have enough time to resolve minor findings and complete documentation.

Does this skill replace a human security auditor?

No, it is designed to handle the 'low-hanging fruit' and documentation, allowing human auditors to focus on complex logic and high-level architectural vulnerabilities.

What documentation does it help generate?

It helps create flowcharts, sequence diagrams, user stories, actor/privilege maps, function invariants, and domain-specific glossaries.

Can it help with failing builds during an audit?

Yes, it includes a specific step to verify build instructions on a fresh environment and freeze a stable version/branch for the audit team.

Audit Prep Assistant

Name: Audit Prep Assistant
Author: trailofbits

bytrailofbits

•

2,924

•

Security & Testing

Prepares codebases for professional security reviews by automating static analysis, optimizing test coverage, and generating architectural documentation.

Audit Prep Assistant is a specialized capability developed by Trail of Bits to streamline the lead-up to a security audit. It guides developers through a structured four-step process: setting strategic review goals, resolving 'low-hanging fruit' via automated static analysis for languages like Solidity, Rust, and Go, increasing test coverage, and generating essential documentation such as flowcharts, user stories, and actor privilege maps. By ensuring build instructions are verified and code is clean before the auditors arrive, it maximizes the effectiveness of manual security reviews.

Key Features

01Automated detection and cleanup of dead code, unused variables, and stale features.

02Automated static analysis integration for Solidity (Slither), Rust (Dylint), and Go (golangci-lint).

03Build environment verification to ensure auditors can compile the project without friction.

04Test coverage analysis and gap identification to ensure all critical paths are exercised.

05Generation of technical documentation including sequence diagrams, state machines, and glossaries.

062,924 GitHub stars

Use Cases

01Standardizing project documentation and build instructions for seamless handoff to external security researchers.

02Internal security hardening to catch common vulnerabilities and increase test confidence before a major release.

03Preparing a DeFi protocol or smart contract system for a third-party security audit 1-2 weeks before the start date.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills audit-prep-assistant

For use in Claude.ai and ChatGPT

Download Skill