A comprehensive orchestration skill that automates professional-grade smart contract audits using static analysis tools and a multi-agent specialist review system.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install smart-contract-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install smart-contract-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Smart Contract Security Audit?
The Smart Contract Security Audit skill is an advanced security framework designed for the Openclaw Skills ecosystem. It automates the complex process of reviewing Solidity code by combining industry-standard static analysis with a sophisticated multi-agent strategy. It doesn't just scan for patterns; it understands protocol context, analyzes test coverage gaps, and spawns specialist agents to investigate specific attack vectors like reentrancy, oracle manipulation, and economic logic errors.
By leveraging Openclaw Skills, developers can perform deep-dive security assessments that include automated triaging, economic feasibility analysis, and the generation of Foundry Proof of Concepts (PoCs). This ensures that findings are not just theoretical, but validated against actual execution costs and practical exploitability, providing a level of depth usually reserved for manual professional audits.
Smart Contract Security Audit Use Cases
- Performing a pre-audit sweep of a DeFi protocol before engaging a professional security firm.
- Auditing GitHub repositories or local directories for common and complex Solidity vulnerabilities.
- Validating upgradeable contract storage layouts to prevent storage collisions during migrations.
- Identifying untested code paths through automated coverage analysis and focusing manual-style reviews on those gaps.
- Generating concrete Foundry PoCs to prove the impact of detected vulnerabilities to stakeholders.
How Smart Contract Security Audit Works
- Target Identification: The skill resolves the audit target from a file, directory, or GitHub URL and detects the underlying framework (Foundry, Hardhat, or Raw Solidity).
- Protocol Classification: It identifies the protocol type (e.g., AMM, Lending, Yield Vault) to apply specialized security 'tricks' and patterns.
- Static Analysis: Slither and Aderyn are run in parallel to catch known vulnerability patterns and low-hanging fruit.
- Specialist Review: Six independent sub-agents are spawned to review the code through specific lenses: Reentrancy, Access Control, Oracles, Flash Loans, Gas/DoS, and Logic Errors.
- Triaging: A senior security 'Triager' agent challenges all Medium+ findings, assessing economic rationality and practical exploitability.
- PoC Generation: For every validated finding, the skill generates a Foundry test file to demonstrate the exploit.
- Reporting: All findings, coverage evidence, and tool outputs are consolidated into a severity-rated Markdown report with Mermaid attack flow diagrams.
Smart Contract Security Audit Setup
To use this skill within the Openclaw Skills environment, ensure you have the necessary security tools installed. You can initialize the environment by running the included setup script:
# Navigate to the skill directory and install dependencies
bash scripts/install-tools.sh
# To start an audit on a target repository
# The skill will automatically handle tool execution and agent spawning
Smart Contract Security Audit Data Schema & Taxonomy
The skill organizes its output in a structured directory to ensure all findings and evidence are easily accessible:
| Directory/File | Description |
|---|---|
audit-output/ |
Root directory for all generated audit data. |
audit-output/poc/ |
Contains Solidity files for Foundry-based Proof of Concepts. |
audit-output/slither.txt |
Raw output from the Slither static analysis run. |
audit-output/aderyn.json |
Detailed report from the Aderyn static analyzer. |
FINAL_REPORT.md |
The consolidated, SEO-optimized security report with SWC classifications. |
Protocol_Summary.md |
Contextual analysis of the protocol architecture and trust model. |
Smart Contract Security Audit Advanced Features
- Multi-Run Strategy: Supports running the audit multiple times to account for LLM variability, using a 'UNION' approach to merge and deduplicate findings.
- Economic Feasibility Analysis: Calculates gas costs, required capital, and expected profit for every validated attack vector.
- Storage Layout Verification: Specifically checks upgradeable contracts for storage slot ordering and
__gaparray consistency. - Solodit Cross-Referencing: Automatically searches real-world audit databases to find similar vulnerabilities and provide historical context.
- Negative Evidence Documentation: Requires agents to document what they checked even when no vulnerabilities are found, ensuring comprehensive coverage verification.
SKILL.md
Loading
Related Openclaw Skills
De-AI-ify Text
A specialized tool that systematically removes AI-generated jargon and patterns to restore an authentic human voice to your writing.
Webflow Designer Extension
A comprehensive development toolkit for building, debugging, and deploying native iframed extensions within the Webflow Designer interface.
Multi-Agent Dispatcher (Generic English Edition)
A sophisticated multi-agent orchestration framework that transforms a primary AI agent into a dedicated commander capable of delegating complex workflows to five persistent sub-agents.
Discogs Claw
A specialized tool for AI agents to retrieve accurate vinyl record market pricing and availability directly from Discogs.
Alchemyst AI MCP
Alchemyst AI MCP is a persistent context layer that allows AI agents to store, retrieve, and semantically search knowledge across different sessions and environments.
Agency Command Center
A comprehensive agency operations system designed to manage the entire client lifecycle from initial inquiry to recurring revenue growth.
Featured*
