audit-context-building
Ultra-granular, line-by-line code analysis to build stable architectural context before vulnerability discovery.
- Performs block-by-block analysis with First Principles, 5 Whys, and 5 Hows applied at micro scale, building and refining a persistent mental model as understanding evolves
- Traces internal and external call chains as continuous execution flows, jumping into available code and modeling black-box calls as adversarial
- Requires structured output with documented invariants, assumptions, risk analysis, and cross-function dependencies; enforces minimum quality thresholds to prevent hallucination
- Reconstructs global system understanding through state mapping, workflow reconstruction, trust boundary identification, and complexity clustering after sufficient micro-analysis
- Explicitly corrects contradictions, anchors key facts periodically, and avoids speculation—designed for security auditing, architecture review, and threat modeling preparation only
Deep Context Builder Skill (Ultra-Granular Pure Context Mode)
1. Purpose
This skill governs how Claude thinks during the context-building phase of an audit.
When active, Claude will:
- Perform line-by-line / block-by-block code analysis by default.
- Apply First Principles, 5 Whys, and 5 Hows at micro scale.
- Continuously link insights → functions → modules → entire system.
- Maintain a stable, explicit mental model that evolves with new evidence.
- Identify invariants, assumptions, flows, and reasoning hazards.
This skill defines a structured analysis format (see Example: Function Micro-Analysis below) and runs before the vulnerability-hunting phase.
2. When to Use This Skill
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.7Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K