SECURITY / trailofbits
Security Audit Preparation
Prepare a frozen, buildable codebase and evidence package for an external security review.
“Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.”
01 / THE REASONING
Why this made the selection.
- The checklist identifies copied code and modifications, documents actors/privileges and on-chain/off-chain assumptions, and treats a reproducible frozen source as an assessment input.
- Give assessors a reproducible commit, dependency inventory, scope map and documented security assumptions.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md
- LICENSE
- README.md
Our findings
- The checklist identifies copied code and modifications, documents actors/privileges and on-chain/off-chain assumptions, and treats a reproducible frozen source as an assessment input.
Not established by this review
- Third-party instructions and helpers were not executed; service access, host compatibility and outcomes remain untested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add trailofbits/skills/plugins/building-secure-contracts/skills/audit-prep-assistantRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/trailofbits/skills/tree/0f44fe01dcb00bd6929b4ba82a257d305de04554/plugins/building-secure-contracts/skills/audit-prep-assistant- Install the pinned directory interactively and retain its referenced files; inspect the source before granting tool access.
- Agree review goals, triage current static-analysis results, reproduce the build in a fresh environment and freeze the assessed commit with dependency versions.
Before you start
- Project compiler/build tools, relevant analyzers and test/coverage tooling
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/0f44fe01dcb00bd6929b4ba82a257d305de04554/plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md
Supports: summary, review, install, access, limitations
- Pinned LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/0f44fe01dcb00bd6929b4ba82a257d305de04554/LICENSE
Supports: license
- Pinned README.md ↗Checked
https://github.com/trailofbits/skills/blob/0f44fe01dcb00bd6929b4ba82a257d305de04554/README.md
Supports: summary, review, install, access, limitations