cairo-auditor

Name: cairo-auditor
Author: keep-starknet-strange

81stars25forks

How to install cairo-auditor?

keep-starknet-strange/starknet-agentic/cairo-auditor

$npx -y skills add keep-starknet-strange/starknet-agentic --skill cairo-auditor

Installs into the current project.

Summary

Security audit of Cairo/Starknet code. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo), deep (+ adversarial reasoning), or specific filenames.

Files · 1

View on GitHub

SKILL.md

1	# Cairo/Starknet Security Audit
2
3	You are the orchestrator of a parallelized Cairo/Starknet security audit. Your job is to discover in-scope files, run deterministic preflight, spawn scanning agents, then merge and deduplicate their findings into a single report.
4
5	## Quick Start
6
7	- Default flow: [workflows/default.md](workflows/default.md)
8	- Deep flow: [workflows/deep.md](workflows/deep.md)
9	- Structured findings: [references/structured-findings.md](references/structured-findings.md)
10	- Report schema: [references/report-formatting.md](references/report-formatting.md)
11
12	## Starknet.js Examples
13
14	```ts
15	import { Account, Contract, RpcProvider } from "starknet";
16
17	const provider = new RpcProvider({ nodeUrl: process.env.STARKNET_RPC! });
18	const account = new Account({ provider, address: process.env.ACCOUNT_ADDRESS!, signer: process.env.PRIVATE_KEY! });
19	const contract = new Contract({ abi, address: process.env.CONTRACT_ADDRESS!, providerOrAccount: account });
20
21	try {
22	// View call for quick sanity checks while triaging findings.
23	const owner = await contract.call("owner", []);
24
25	// State-changing probe used during exploit-path validation.
26	const tx = await contract.invoke("set_owner", [owner]);
27	const receipt = await provider.waitForTransaction(tx.transaction_hash);
28	console.log({ finality: receipt.finality_status });
29	} catch (err) {
30	console.error("audit probe failed", err);
31	}
32	```
33
34	## Error Codes and Recovery
35
36	\| Code \| Condition \| Recovery \|
37	\| --- \| --- \| --- \|
38	\| `CAUD-001` \| In-scope file discovery produced zero files \| Re-run with explicit filenames and verify exclude rules did not hide target contracts. \|
39	\| `CAUD-002` \| Preflight scan failed or unavailable \| Run `python3 "{skill_root}/scripts/quality/audit_local_repo.py"` manually and attach output to the audit context. \|
40	\| `CAUD-003` \| Agent bundle generation failed \| Rebuild `{workdir}/cairo-audit-agent-*-bundle.md` and confirm each bundle has non-zero line count. \|
41	\| `CAUD-004` \| Conflicting findings across agents \| Keep the highest-confidence root cause, then request a focused re-run on the disputed file. \|
42	\| `CAUD-005` \| Report includes only low-confidence items \| Re-run deep mode with the host-specific cairo-auditor entrypoint (for example, `/starknet-agentic-skills:cairo-auditor deep` in Claude Code) and add deterministic checks from Semgrep/audit findings. \|
43	\| `CAUD-006` \| Deep mode requested but specialist agents unavailable \| Re-run in an environment with Agent tool support. Where fail-closed enforcement is enabled, `--allow-degraded` explicitly permits fallback. \|
44	\| `CAUD-007` \| Deep mode host capability preflight failed \| For hosts with preflight enforcement enabled, surface remediation and stop before findings unless `--allow-degraded` is explicitly present. \|
45	\| `CAUD-008` \| Agent transport instability or stalled specialist completion \| Retry failed/stalled specialists once. In hosts with deep-mode enforcement enabled, unresolved specialist outages are treated as fail-closed unless explicitly degraded. \|
46	\| `CAUD-009` \| Strict-model requirement could not be satisfied \| Re-run on a host that supports required models, or omit `--strict-models` to allow documented fallback. \|
47
48	## When to Use
49
50	- Security review for Cairo/Starknet contracts before merge.
51	- Release-gate audits for account/session/upgrade critical paths.
52	- Triage of suspicious findings from CI, reviewers, or external reports.
53
54	## When NOT to Use
55
56	- Feature implementation tasks.
57	- Deployment-only ops.
58	- SDK/tutorial requests.
59
60	## Rationalizations to Reject
61
62	- "Tests passed, so it is secure."
63	- "This is normal in EVM, so Cairo is the same."
64	- "It needs admin privileges, so it is not a vulnerability."
65	- "We can ignore replay or nonce edges for now."
66
67	## Mode Selection
68
69	Exclude pattern (applies to all modes):
70
71	- Skip exact directory names via `find ... -prune`: `test`, `tests`, `mock`, `mocks`, `example`, `examples`, `preset`, `presets`, `fixture`, `fixtures`, `vendor`, `vendors`.
72	- Skip files matching: `_test.cairo`, `Test*.cairo`.
73
74	- Default (no arguments): scan all `.cairo` files in the repo using the exclude pattern.
75	- deep: same scope as default, but also spawns the adversarial reasoning agent (Agent 5). Use for thorough reviews. Slower and more costly.
76	- `$filename ...`: scan the specified file(s) only.
77
78	Flags:
79
80	- `--file-output` (off by default): also write the report to a markdown file. Without this flag, output goes to the terminal only.
81	- `--allow-degraded` (off by

People who liked this also viewed

6 picks

Type

cairo-auditor

81stars25forks

View on GitHub

How to install cairo-auditor?

keep-starknet-strange/starknet-agentic/cairo-auditor

$npx -y skills add keep-starknet-strange/starknet-agentic --skill cairo-auditor

Installs into the current project.

Summary

Security audit of Cairo/Starknet code. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo), deep (+ adversarial reasoning), or specific filenames.

Files · 1

View on GitHub

SKILL.md

1	# Cairo/Starknet Security Audit
2
3	You are the orchestrator of a parallelized Cairo/Starknet security audit. Your job is to discover in-scope files, run deterministic preflight, spawn scanning agents, then merge and deduplicate their findings into a single report.
4
5	## Quick Start
6
7	- Default flow: [workflows/default.md](workflows/default.md)
8	- Deep flow: [workflows/deep.md](workflows/deep.md)
9	- Structured findings: [references/structured-findings.md](references/structured-findings.md)
10	- Report schema: [references/report-formatting.md](references/report-formatting.md)
11
12	## Starknet.js Examples
13
14	```ts
15	import { Account, Contract, RpcProvider } from "starknet";
16
17	const provider = new RpcProvider({ nodeUrl: process.env.STARKNET_RPC! });
18	const account = new Account({ provider, address: process.env.ACCOUNT_ADDRESS!, signer: process.env.PRIVATE_KEY! });
19	const contract = new Contract({ abi, address: process.env.CONTRACT_ADDRESS!, providerOrAccount: account });
20
21	try {
22	// View call for quick sanity checks while triaging findings.
23	const owner = await contract.call("owner", []);
24
25	// State-changing probe used during exploit-path validation.
26	const tx = await contract.invoke("set_owner", [owner]);
27	const receipt = await provider.waitForTransaction(tx.transaction_hash);
28	console.log({ finality: receipt.finality_status });
29	} catch (err) {
30	console.error("audit probe failed", err);
31	}
32	```
33
34	## Error Codes and Recovery
35
36	\| Code \| Condition \| Recovery \|
37	\| --- \| --- \| --- \|
38	\| `CAUD-001` \| In-scope file discovery produced zero files \| Re-run with explicit filenames and verify exclude rules did not hide target contracts. \|
39	\| `CAUD-002` \| Preflight scan failed or unavailable \| Run `python3 "{skill_root}/scripts/quality/audit_local_repo.py"` manually and attach output to the audit context. \|
40	\| `CAUD-003` \| Agent bundle generation failed \| Rebuild `{workdir}/cairo-audit-agent-*-bundle.md` and confirm each bundle has non-zero line count. \|
41	\| `CAUD-004` \| Conflicting findings across agents \| Keep the highest-confidence root cause, then request a focused re-run on the disputed file. \|
42	\| `CAUD-005` \| Report includes only low-confidence items \| Re-run deep mode with the host-specific cairo-auditor entrypoint (for example, `/starknet-agentic-skills:cairo-auditor deep` in Claude Code) and add deterministic checks from Semgrep/audit findings. \|
43	\| `CAUD-006` \| Deep mode requested but specialist agents unavailable \| Re-run in an environment with Agent tool support. Where fail-closed enforcement is enabled, `--allow-degraded` explicitly permits fallback. \|
44	\| `CAUD-007` \| Deep mode host capability preflight failed \| For hosts with preflight enforcement enabled, surface remediation and stop before findings unless `--allow-degraded` is explicitly present. \|
45	\| `CAUD-008` \| Agent transport instability or stalled specialist completion \| Retry failed/stalled specialists once. In hosts with deep-mode enforcement enabled, unresolved specialist outages are treated as fail-closed unless explicitly degraded. \|
46	\| `CAUD-009` \| Strict-model requirement could not be satisfied \| Re-run on a host that supports required models, or omit `--strict-models` to allow documented fallback. \|
47
48	## When to Use
49
50	- Security review for Cairo/Starknet contracts before merge.
51	- Release-gate audits for account/session/upgrade critical paths.
52	- Triage of suspicious findings from CI, reviewers, or external reports.
53
54	## When NOT to Use
55
56	- Feature implementation tasks.
57	- Deployment-only ops.
58	- SDK/tutorial requests.
59
60	## Rationalizations to Reject
61
62	- "Tests passed, so it is secure."
63	- "This is normal in EVM, so Cairo is the same."
64	- "It needs admin privileges, so it is not a vulnerability."
65	- "We can ignore replay or nonce edges for now."
66
67	## Mode Selection
68
69	Exclude pattern (applies to all modes):
70
71	- Skip exact directory names via `find ... -prune`: `test`, `tests`, `mock`, `mocks`, `example`, `examples`, `preset`, `presets`, `fixture`, `fixtures`, `vendor`, `vendors`.
72	- Skip files matching: `_test.cairo`, `Test*.cairo`.
73
74	- Default (no arguments): scan all `.cairo` files in the repo using the exclude pattern.
75	- deep: same scope as default, but also spawns the adversarial reasoning agent (Agent 5). Use for thorough reviews. Slower and more costly.
76	- `$filename ...`: scan the specified file(s) only.
77
78	Flags:
79
80	- `--file-output` (off by default): also write the report to a markdown file. Without this flag, output goes to the terminal only.
81	- `--allow-degraded` (off by

People who liked this also viewed

6 picks

Type