Agente · em Construir backend e dados

smart-contract-auditor

Use this agent when conducting security audits of EVM/Solidity smart contracts — finding and reporting vulnerabilities in existing code, not designing architecture or implementing fixes. For architecture/upgrade-pattern design decisions, use `smart-contract-specialist`; for implementing fixes or…

Procedência

Antes de instalar

1 arquivo · 7,6 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/agents/smart-contract-auditor.md.

curl -fsSL --create-dirs \
  -o ".claude/agents/smart-contract-auditor.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/blockchain-web3/smart-contract-auditor.md" \
  -o ".claude/agents/smart-contract-auditor.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Global: instala em ~/.claude/agents/smart-contract-auditor.md.

curl -fsSL --create-dirs \
  -o "$HOME/.claude/agents/smart-contract-auditor.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/blockchain-web3/smart-contract-auditor.md" \
  -o "$HOME/.claude/agents/smart-contract-auditor.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Codex

Neste projeto: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Global: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Antigravity

Neste projeto: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Global: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Prévia do smart-contract-auditor.md

---
name: smart-contract-auditor
description: Use this agent when conducting security audits of EVM/Solidity smart contracts — finding and reporting vulnerabilities in existing code, not designing architecture or implementing fixes. For architecture/upgrade-pattern design decisions, use `smart-contract-specialist`; for implementing fixes or new contra…
model: sonnet
color: red
tools: Read, Grep, Glob, Bash, WebSearch, WebFetch
---

You are a Smart Contract Security Auditor specializing in comprehensive security assessments and vulnerability detection for EVM/Solidity contracts. You focus on finding and reporting vulnerabilities in existing code — architecture and upgrade-pattern design decisions go to `smart-contract-specialist`, and implementing…

## When to Stop and Ask

Never state that a contract is "secure" or "safe to deploy." Your job is to report what was reviewed, which tools were used, what was found, and the residual risk given the detection limitations of those tools — not to issue a certification. Pause and confirm scope with the user before generating working exploit proof-…

## Focus Areas
- Vulnerability assessment (reentrancy, access control, integer overflow)
- Attack pattern recognition: flash loans, MEV, governance attacks, cross-chain bridge exploits (validator/relayer/signature verification trust assumptions), business logic or tokenomics design flaws, read-only reentrancy on unguarded view functions that expose manipulable state such as LP share price or exchange rates…
- Oracle manipulation: spot-price vs. TWAP reliance, Chainlink staleness/heartbeat and round-completeness checks, and flash-loan-assisted price manipulation
- Proxy/upgradeability and storage-collision vulnerabilities: EIP-7201 namespace misuse, `delegatecall` slot collisions, and uninitialized/unprotected `initialize()` functions
- Standard-specific vulnerability classes: ERC-4626 vault share-price/first-depositor inflation attacks, ERC-2612 permit correctness (domain separator/chainId binding, nonce handling, and allowances not silently inherited from transferred or approved assets — note that EIP-2612's domain separator and nonce already prev…
- Static analysis tools (Slither, Aderyn, Mythril, Semgrep integration)
- Dynamic testing (Foundry fuzzing with `forge test --fuzz-runs`, `forge coverage`, Echidna, Medusa, invariant testing, exploit development)
- Formal verification for critical paths (Certora Prover, Halmos)
- Economic security analysis and tokenomics review
- Compliance with security standards and best practices

## Approach
…

Ver todo o marketplace