Audit

---
description: Orchestrated parallel security audit — spawns teammates to run 20+ audit skills against a Solidity codebase
argument-hint: [path] — Solidity project root (default: current directory)
allowed-tools:
  - Read
  - Write
  - Edit
  - Glob
  - Grep
  - Skill
  - Task
  - SendMessage
  - TeamCreate
  - TeamDelete
  - TaskCreate
  - TaskUpdate
  - TaskList
  - Bash(find *)
  - Bash(ls *)
  - Bash(mkdir *)
  - Bash(tree *)
model: inherit
context: inherit
hooks: {}
user-invocable: true
---

# Audit

Orchestrated security audit. Creates a team and spawns teammates across 5 waves to run 20 specialized audit skills against a Solidity codebase. Each teammate invokes one skill via `Skill` tool and writes findings to `.audit-work/`.

## Input

- **$ARGUMENTS** — Project root path (optional, defaults to cwd)

## Excluded

`sc-auditor-security` has interactive USER GATES — run it separately via `/sc-auditor-security <path>`.

## Execution

### Step 1: Validate Target

```bash
find ${TARGET:-.} -name "*.sol" -not -path "*/node_modules/*" -not -path "*/lib/*" | head -5
```

If no `.sol` files found, stop and tell the user. Set `$TARGET` to resolved path.

```bash
mkdir -p .audit-work
```

### Step 2: Create Team and Tasks

```
TeamCreate(team_name="audit", description="Parallel security audit across 20 skills")
```

Create ALL 20 tasks upfront:

```
TaskCreate(subject="entry-point-analyzer", description="Map state-changing entry points by access level")
TaskCreate(subject="audit-prep-assistant", description="Pre-audit codebase preparation and documentation")
TaskCreate(subject="audit-context-building", description="Ultra-granular line-by-line code context")
TaskCreate(subject="audit-lending", description="Lending/borrowing protocol vulnerabilities")
TaskCreate(subject="audit-reentrancy", description="Reentrancy attack vectors")
TaskCreate(subject="audit-math-precision", description="Arithmetic precision and rounding errors")
TaskCreate(subject="audit-oracle", description="Oracle integration vulnerabilities")
TaskCreate(subject="audit-signature", description="Signature replay and malleability")
TaskCreate(subject="audit-staking", description="Staking/reward protocol vulnerabilities")
TaskCreate(subject="audit-state-validation", description="State validation and access control")
TaskCreate(subject="audit-slippage", description="DEX slippage and sandwich attacks")
TaskCreate(subject="audit-liquidation", description="Liquidation incentive structure")
TaskCreate(subject="audit-auction", description="Auction mechanism manipulation")
TaskCreate(subject="audit-liquidation-dos", description="Liquidation denial of service")
TaskCreate(subject="audit-liquidation-calculation", description="Liquidation calculation errors")
TaskCreate(subject="audit-unfair-liquidation", description="Unfair liquidation timing")
TaskCreate(subject="audit-clm", description="Concentrated liquidity manager issues")
TaskCreate(subject="pashov-solidity-auditor", description="Parallel vector-scan security audit")
TaskCreate(subject="token-integration-analyzer", description="Token conformity and weird ERC20 patterns")
TaskCreate(subject="guidelines-advisor", description="Trail of Bits best practices assessment")
```

### Step 3: Wave 1 — Recon

Spawn 3 teammates in a **single message**:

```
Task(
  name="w1-entry-points",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-entry-points on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"entry-point-analyzer\" (owner=\"w1-entry-points\", status=\"in_progress\")
2. mkdir -p .audit-work/entry-point-analyzer
3. Use the Skill tool: skill=\"entry-point-analyzer\", args=\"$TARGET\"
4. Write the skill output to .audit-work/entry-point-analyzer/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary of entry point counts"
)

Task(
  name="w1-audit-prep",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-audit-prep on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"audit-prep-assistant\" (owner=\"w1-audit-prep\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-prep-assistant
3. Use the Skill tool: skill=\"audit-prep-assistant\"
   The skill prepares the codebase for security review.
4. Write the skill output to .audit-work/audit-prep-assistant/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary"
)

Task(
  name="w1-context",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w1-context on team \"audit\".

TARGET: $TARGET

Your job:
1. TaskUpdate: claim task \"audit-context-building\" (owner=\"w1-context\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-context-building
3. Use the Skill tool: skill=\"audit-context-building\"
   The skill builds deep architectural context via line-by-line analysis.
4. Write the skill output to .audit-work/audit-context-building/FINDINGS.md
5. TaskUpdate: complete task (status=\"completed\")
6. SendMessage to team lead: 2-line summary of context discovered"
)
```

Wait for all 3 to complete. Verify via `TaskList`.

### Step 4: Wave 2 — Domain Scans A

Spawn 5 teammates in a **single message**:

```
Task(
  name="w2-lending",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-lending on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-lending\" (owner=\"w2-lending\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-lending
3. Use the Skill tool: skill=\"audit-lending\"
4. Write findings to .audit-work/audit-lending/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-reentrancy",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-reentrancy on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-reentrancy\" (owner=\"w2-reentrancy\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-reentrancy
3. Use the Skill tool: skill=\"audit-reentrancy\"
4. Write findings to .audit-work/audit-reentrancy/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-math",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-math on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-math-precision\" (owner=\"w2-math\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-math-precision
3. Use the Skill tool: skill=\"audit-math-precision\"
4. Write findings to .audit-work/audit-math-precision/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-oracle",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-oracle on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-oracle\" (owner=\"w2-oracle\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-oracle
3. Use the Skill tool: skill=\"audit-oracle\"
4. Write findings to .audit-work/audit-oracle/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)

Task(
  name="w2-signature",
  subagent_type="general-purpose",
  team_name="audit",
  model="sonnet",
  prompt="You are audit teammate w2-signature on team \"audit\".

TARGET: $TARGET

1. TaskUpdate: claim task \"audit-signature\" (owner=\"w2-signature\", status=\"in_progress\")
2. mkdir -p .audit-work/audit-signature
3. Use the Skill tool: skill=\"audit-signature\"
4. Write findings to .audit-work/audit-signature/FINDINGS.md
5. TaskUpdate: complete (status=\"completed\")
6. SendMessage to team lead: findings count + severity summary"
)
```

Wait for all 5. Verify via `TaskList`.

### Step 5: Wave 3 — Domain Scans B

Spawn 5 teammates in a **single message**:

| Name | Skill | Task subject |
|------|-------|-------------|
| `w3-staking` | `audit-staking` | `audit-staking` |
| `w3-state` | `audit-state-validation` | `audit-state-validation` |
| `w3-slippage` | `audit-slippage` | `audit-slippage` |
| `w3-liquidation` | `audit-liquidation` | `audit-liquidation` |
| `w3-auction` | `audit-auction` | `audit-auction` |

Use the same prompt template as Wave 2 — substitute skill name, teammate name, and task subject.

Wait for all 5. Verify via `TaskList`.

### Step 6: Wave 4 — Domain Scans C

Spawn 5 teammates in a **single message**:

| Name | Skill | Task subject |
|------|-------|-------------|
| `w4-liq-dos` | `audit-liquidation-dos` | `audit-liquidation-dos` |
| `w4-liq-calc` | `audit-liquidation-calculation` | `audit-liquidation-calculation` |
| `w4-unfair-liq` | `audit-unfair-liquidation` | `audit-unfair-liquidation` |
| `w4-clm` | `audit-clm` | `audit-clm` |
| `w4-pashov` | `pashov-solidity-auditor` | `pashov-solidity-auditor` |

Same prompt template. Wait for all 5. Verify via `TaskList`.

### Step 7: Wave 5 — Deep Analysis

Spawn 2 teammates in a **single message**:

| Name | Skill | Task subject |
|------|-------|-------------|
| `w5-token` | `token-integration-analyzer` | `token-integration-analyzer` |
| `w5-guidelines` | `guidelines-advisor` | `guidelines-advisor` |

Same prompt template. Wait for both. Verify via `TaskList`.

### Step 8: Synthesize Report

Read all findings:

```bash
ls .audit-work/*/FINDINGS.md
```

Read each FINDINGS.md. Write `.audit-work/REPORT.md`:

```markdown
# Security Audit Report

**Target:** $TARGET
**Date:** $(date)
**Skills executed:** 20

## Executive Summary

[2-3 sentences: total findings, severity breakdown, most critical areas]

## Findings by Severity

### Critical
[Deduplicated findings rated Critical/High across all skills]
- **Source:** skill name | **File:** path:line | **Issue:** description | **Fix:** remediation

### High
[...]

### Medium
[...]

### Low / Informational
[...]

## Coverage Matrix

| Skill | Status | Findings | Critical | High | Medium | Low |
|-------|--------|----------|----------|------|--------|-----|
| entry-point-analyzer | ✓/✗ | N | ... |
| audit-lending | ✓/✗ | N | ... |
| ... |

## Recon Summary

### Entry Points
[From w1-entry-points]

### Architectural Context
[From w1-context]

## Next Steps

- [ ] Run `/sc-auditor-security $TARGET` for interactive deep audit with proof generation
- [ ] Address Critical findings immediately
- [ ] Review High findings for exploitability
```

### Step 9: Shutdown

```
SendMessage(type="shutdown_request", recipient="broadcast", content="Audit complete. Shutting down.")
TeamDelete(team_name="audit")
```

Tell the user:
1. Report location: `.audit-work/REPORT.md`
2. Individual findings: `.audit-work/<skill-name>/FINDINGS.md`
3. Suggest: `/sc-auditor-security $TARGET` for interactive deep audit

## Teammate Prompt Template

All teammates use this template (substitute `$NAME`, `$SKILL`, `$TASK_SUBJECT`):

```
You are audit teammate $NAME on team "audit".

TARGET: $TARGET

1. TaskUpdate: claim task "$TASK_SUBJECT" (owner="$NAME", status="in_progress")
2. mkdir -p .audit-work/$SKILL
3. Use the Skill tool: skill="$SKILL"
4. Write findings to .audit-work/$SKILL/FINDINGS.md
5. TaskUpdate: complete (status="completed")
6. SendMessage to team lead: findings count + severity summary
```

## Execution Rules

1. **All teammates use `Skill` tool** — never inline skill work (SkillFlattening anti-pattern)
2. **Spawn all wave teammates in a single message** — true parallel execution
3. **Max 5 teammates per wave** — per CLAUDE.md constraint
4. **Wait between waves** — `TaskList` before launching next wave
5. **Use `Task` tool with `team_name`** — standalone `Agent()` cannot call skills
6. **Shutdown before TeamDelete** — send shutdown_request, wait for confirmations
7. **Deduplicate findings** — multiple skills may flag the same root cause
8. **Severity normalization** — map each skill's scale to Critical/High/Medium/Low

## Skill Relevance

Not all skills produce findings on every codebase. If a skill finds nothing (e.g., `audit-lending` on a non-lending protocol), the teammate writes "No relevant patterns found" to FINDINGS.md and completes the task.

## Examples

```bash
# Audit current directory
/orc:audit

# Audit specific project
/orc:audit ~/git/my-defi-protocol

# Audit subdirectory
/orc:audit src/contracts/
```