audit-prep-assistant
Prepares codebases for security audits using Trail of Bits' checklist across four structured phases.
- Helps define review goals by identifying security concerns, previous issues, and worst-case scenarios, then documents them for the assessment team
- Runs platform-specific static analysis tools (Slither for Solidity, Dylint for Rust, Golangci-lint for Go, CodeQL and Semgrep for multiple languages) and triages findings
- Increases test coverage, identifies and removes dead code, and generates a clean codebase snapshot with frozen commit hash and dedicated branch
- Creates comprehensive documentation including architecture flowcharts, user stories, glossaries, actor/privilege maps, NatSpec comments, and on-chain/off-chain assumptions
Audit Prep Assistant
Purpose
Helps prepare for a security review using Trail of Bits' checklist. A well-prepared codebase makes the review process smoother and more effective.
Use this: 1-2 weeks before your security audit
The Preparation Process
Step 1: Set Review Goals
Helps define what you want from the review:
Key Questions:
- What's the overall security level you're aiming for?
- What areas concern you most?
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K