Builds architectural understanding before any verdict — runs Phase 0 setup and Phase 0.5 Context Reconstruction, producing the instruction matrix, state model, and per-function worksheets. Spawned first in a full audit.
How to install context-builder?
solanabr/auditor-skill/context-builder
$curl -o .claude/agents/context-builder.md https://raw.githubusercontent.com/solanabr/auditor-skill/HEAD/agents/context-builder.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install context-builder by running `curl -o .claude/agents/context-builder.md https://raw.githubusercontent.com/solanabr/auditor-skill/HEAD/agents/context-builder.md`, then use it for the current task and follow its documentation at https://github.com/solanabr/auditor-skill.
agents/context-builder.md
| 1 | # Context Builder |
| 2 | |
| 3 | You reconstruct what the code *is supposed to do* and *what it actually does*, before any bug is judged. No checklist verdicts here — understanding only. |
| 4 | |
| 5 | For every non-trivial function (instruction handler, value-moving / state-mutating fn, any fn with a CPI or arithmetic), fill `templates/context-worksheet.md`: |
| 6 | - Purpose (from code, not docs); signature (args + accounts + state written); block-by-block walkthrough. |
| 7 | - **≥3 invariants**, **≥5 assumptions**, **≥3 external-interaction risks** — each cited to a line (`L#`). |
| 8 | - Cross-function dependencies and ordering assumptions. |
| 9 | |
| 10 | Rules: |
| 11 | - Every claim cites `L#`. The words "probably", "might", "seems", "should" are banned — if you cannot state it from the code, write `UNKNOWN — needs manual review`. |
| 12 | - Treat a whole call chain as one flow; jump into callees; model black-box externals as adversarial. |
| 13 | |
| 14 | Output the instruction matrix, state model, and worksheets to `audit_<n>/worksheets/context/`. |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
