Commands Skill

Purpose

Provides structured command patterns for invoking audit capabilities through the plugin. Each command maps to one or more underlying skills, loads the correct context, and executes the appropriate workflow.

Command Reference

/audit <contract|directory>

Purpose: Run a full comprehensive security audit.

Parameter	Required	Example	Description
<target>	Yes	Vault.sol, src/	Contract file or directory to audit
--chain	No	ethereum, arbitrum	Target chain (default: ethereum)
--type	No	defi, nft, bridge	Protocol type for checklist selection
--depth	No	quick, comprehensive	Audit depth (default: comprehensive)

Skills invoked: solidity-scanner → methodology/comprehensive-audit → checklists → report-writer

Example:

/audit src/Vault.sol --chain arbitrum --type defi

Output: Full audit report with findings grouped by severity, root cause analysis, PoC code, and fix recommendations.

---

/scan <contract>

Purpose: Fast 15–20 minute vulnerability scan for triage or contest warm-up.

Parameter	Required	Example	Description
<target>	Yes	Token.sol	Contract file to scan
--focus	No	reentrancy, access	Narrow scan to specific area

Skills invoked: solidity-scanner/workflows/quick-scan → severity/SKILL.md

Example:

/scan src/LendingPool.sol --focus reentrancy

Output: Prioritized list of potential vulnerabilities with severity estimates and quick-fix suggestions.

---

/checklist <protocol-type>

Purpose: Load a protocol-specific security checklist.

Parameter	Required	Example	Description
<type>	Yes	erc20, erc4626, amm, lending, bridge	Protocol or token standard
--format	No	markdown, interactive	Output format

Available checklists:

Type	Description	Items
erc20	ERC-20 token compliance + security	Transfer, approval, supply checks
erc721	NFT contract security	Minting, ownership, royalty checks
erc4626	Tokenized vault security	Share math, first depositor, inflation
amm	Automated market maker	Slippage, oracle, MEV, pool manipulation
lending	Lending protocol	Liquidation, interest, collateral, oracle
bridge	Cross-chain bridge	Message verification, replay, finality
governance	DAO governance	Flash loan voting, quorum, timelock
staking	Staking contracts	Reward calculation, withdrawal, unbonding
proxy	Upgradeable contracts	Storage layout, initialization, access

Skills invoked: checklists/ → protocol-specific checklist file

Example:

/checklist erc4626

---

/report

Purpose: Generate formatted audit report from collected findings.

Parameter	Required	Example	Description
--format	No	markdown, pdf, json	Report format (default: markdown)
--template	No	standard, contest, client	Report template
--include-gas	No	flag	Include gas optimization findings

Skills invoked: report-writer/SKILL.md

Output structure:

1. Executive Summary
2. Scope and Methodology
3. Findings (Critical → High → Medium → Low → Informational)
4. Each finding: Title, Severity, Description, Impact, PoC, Recommendation
5. Appendix: Tool outputs, gas analysis

Example:

/report --format markdown --template contest

---

/severity <finding-description>

Purpose: Classify a finding's severity using structured criteria.

Parameter	Required	Example	Description
<description>	Yes	"unchecked return value in withdraw"	Brief description of the finding
--context	No	"vault holds 10M USDC"	Additional context for severity

Skills invoked: severity/SKILL.md → scoring/SKILL.md

Assessment criteria applied:

1. Impact: What can go wrong? (fund loss, DoS, governance)
2. Likelihood: How likely is exploitation? (attacker cost, prerequisites)
3. Scope: Who is affected? (single user, all users, protocol)
4. Existing mitigations: Any guards already in place?

Example:

/severity "reentrancy in withdraw() allows drain" --context "vault holds 10M USDC"

Output: Severity rating (Critical/High/Medium/Low) with detailed justification and comparable historical findings.

---

/patterns <category>

Purpose: Browse the vulnerability pattern catalog for a specific category.

Parameter	Required	Example	Description
<category>	Yes	reentrancy, oracle, access, token, math	Pattern category
--chain	No	solana, move	Chain-specific patterns

Available categories:

Category	Patterns Covered
reentrancy	Single, cross-function, cross-contract, read-only, ERC777, ERC721
oracle	Spot price, stale price, reserve-based, circular dependency, decimal mismatch
access	Missing modifier, unprotected init, wrong role, delegatecall bypass
token	Fee-on-transfer, rebasing, non-standard decimals, approve race, blacklist
math	Rounding, first depositor, precision loss, overflow, fee calculation
mev	Sandwich, missing deadline, missing slippage, permit front-running
signature	Replay, malleable, missing nonce, missing chainId, ecrecover zero
proxy	Storage collision, uninitialized impl, UUPS missing guard, selector clash
dos	Unbounded loop, external call revert, griefing, self-destruct force-send

Skills invoked: patterns/SKILL.md → variant-analysis/resources/variant-patterns.md

Example:

/patterns reentrancy

---

/chain-guide <chain>

Purpose: Load chain-specific security considerations and audit context.

Parameter	Required	Example	Description
<chain>	Yes	ethereum, solana, move, cosmos	Target chain
--focus	No	gas, consensus, bridges	Specific area within chain

Supported chains:

Chain	Scanner	Key Differences
Ethereum / EVM	solidity-scanner/	Baseline — reentrancy, MEV, gas
Solana	solana-scanner/	Account model, PDA, CPI, no reentrancy guard
Move (Aptos/Sui)	move-scanner/	Resource model, abilities, module publish
Cairo (Starknet)	cairo-scanner/	Felt252, storage proofs, Sierra
CosmWasm	cosmos-scanner/	IBC, message handling, gas metering
Fuel (Sway)	fuel-scanner/	UTXO, predicates, scripts
TON (FunC/Tact)	ton-scanner/	Actor model, async messages, bouncing
Aztec (Noir)	aztec-scanner/	Privacy, encrypted state, kernel proofs

Skills invoked: chain-guides/ → chain-specific scanner SKILL.md

Example:

/chain-guide solana --focus accounts

---

/fix-review <finding-id>

Purpose: Review a proposed fix to verify it correctly addresses the vulnerability.

Parameter	Required	Example	Description
<finding>	Yes	H-01, reentrancy in withdraw	Finding ID or description
--diff	No	fix-branch..main	Git diff to review

Skills invoked: fix-review/SKILL.md → variant-analysis/SKILL.md

Checks performed:

1. Root cause addressed (not just symptom)
2. No new vulnerabilities introduced
3. All variant instances also fixed
4. Edge cases covered
5. Tests added for the vulnerability
6. No regressions to existing functionality

Example:

/fix-review H-01 --diff fix/reentrancy..main

---

/variant <bug-description>

Purpose: Run variant analysis from a known bug to find all related instances.

Parameter	Required	Example	Description
<description>	Yes	"reentrancy in withdraw()"	Bug description to hunt variants for
--scope	No	all, contract, module	Search scope (default: all)

Skills invoked: variant-analysis/SKILL.md → variant-analysis/workflows/variant-hunt.md

Example:

/variant "unchecked return value in transfer" --scope all

---

/exploit <protocol-name>

Purpose: Load historical exploit forensics for a protocol or exploit category.

Parameter	Required	Example	Description
<name>	Yes	euler, curve, reentrancy	Protocol name or exploit category

Skills invoked: exploit-forensics/ → specific case study file

Example:

/exploit euler

---

Command Chaining

Commands can be logically chained for complex workflows:

/scan Vault.sol                          → Find initial vulnerabilities
/variant "reentrancy in withdraw()"      → Find all variants
/severity "reentrancy across 3 functions" → Classify aggregate severity
/report --template contest               → Generate contest submission

Error Handling

Error	Response
Unknown command	Suggest closest matching command
Missing required parameter	Prompt with parameter description and example
Unsupported chain	List all supported chains
No findings found	Report clean result with confidence level and areas covered
File not found	Prompt for correct path with workspace file listing

Resources

• Implementation Guide