New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Foundry Reference Spec Audit

by aviggiano in aviggiano/security

Audit a Solidity reference implementation against a protocol whitepaper or public specification.

MITAuto-check passedDocuments & Office

Install Foundry Reference Spec Audit

skills CLI
$ npx skills add aviggiano/security --skill foundry-reference-spec-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aviggiano/security foundry-reference-spec-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aviggiano/security.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/foundry-reference-spec-audit .claude/skills/foundry-reference-spec-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
foundry-reference-spec-audit
GitHub stars
144
Token cost
~495 tokens
SKILL.md length
234 words
Files
2
Skills in repo
10
Repo updated
First seen
Licence
MIT

At a glance

Audit a Solidity reference implementation against a protocol whitepaper or public specification.

  • Works in 6 steps: List the reference surfaces in scope. → Map each surface to its public spec… → Check inputs, outputs, rounding, failure… → …
  • Codex needs to decide whether reference-model behavior
  • SKILL.md covers Purpose, Source Rules, Audit Workflow and What To Look For, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Foundry Reference Spec Audit is an agent skill from aviggiano/security. Audit a Solidity reference implementation against a protocol whitepaper or public specification. Use when Codex needs to decide whether reference-model behavior, math, edge cases, or unsupported surfaces match the spec before creating or trusting Foundry differential tests.

Its SKILL.md is about 500 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).

It sits in Documents & Office, covering Report writing and Smart contracts. It works with Solidity. The repository describes itself as: Security Reviews and Audit Checklists. The licence is MIT.

When your agent uses it

  • Codex needs to decide whether reference-model behavior
  • Unsupported surfaces match the spec before creating
  • Trusting Foundry differential tests

Example prompts

  • “/foundry-reference-spec-audit”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

  1. List the reference surfaces in scope.
  2. Map each surface to its public spec source.
  3. Check inputs, outputs, rounding, failure modes, state transitions, and accounting side effects.
  4. Mark each surface as conformant, reference gap, ambiguous spec, or out of scope.
  5. Recommend reference fixes only for reference gap.
  6. Recommend new property or differential tests for important spec claims that are not covered.

What it can do on your machine

Read from SKILL.md and the folder at commit e18ce7d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Foundry Reference Spec Audit loads about 495 tokens when it runs. Until then it costs about 76 tokens; SKILL.md has 234 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~76
When it runs · the whole SKILL.md, loaded when a task matches
~495

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aviggiano/security at commit e18ce7d, republished under its MIT licence (© aviggiano). 234 words, ~495 tokens.

Download SKILL.mdSave it as .claude/skills/foundry-reference-spec-audit/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
foundry-reference-spec-audit
description
Audit a Solidity reference implementation against a protocol whitepaper or public specification. Use when Codex needs to decide whether reference-model behavior, math, edge cases, or unsupported surfaces match the spec before creating or trusting Foundry differential tests.

Foundry Reference Spec Audit

Purpose

Use this pass before treating a reference model as an oracle. The reference is allowed to be incomplete, but it must not silently encode behavior that disagrees with the public spec for surfaces it claims to cover.

Source Rules

Use current public sources:

  • whitepaper or protocol specification
  • README/API docs
  • public interfaces
  • public tests

If the source is a URL or PDF, fetch or browse it when needed and record the exact source in the summary. Do not derive spec meaning from production implementation files when the repository forbids it.

Audit Workflow

  1. List the reference surfaces in scope.
  2. Map each surface to its public spec source.
  3. Check inputs, outputs, rounding, failure modes, state transitions, and accounting side effects.
  4. Mark each surface as conformant, reference gap, ambiguous spec, or out of scope.
  5. Recommend reference fixes only for reference gap.
  6. Recommend new property or differential tests for important spec claims that are not covered.

What To Look For

  • math formulas and rounding direction
  • exact-in vs exact-out semantics
  • partial fill and complete-fill behavior
  • batch atomicity and required-action behavior
  • priority rules
  • reserve and balance conservation
  • lifecycle/permission gates
  • public view consistency
  • documented ABI limits, such as bit-width or enum ranges

Output

Return a table:

SurfaceSpec sourceReference statusFindingRecommendation

Do not patch the reference during the audit unless the user explicitly asks for implementation after the report.

© aviggiano, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/foundry-reference-spec-audit of aviggiano/security.

  • SKILL.md
  • agents/openai.yaml

Open the folder on GitHubat commit e18ce7d

Compare with similar skills

Foundry Reference Spec Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Foundry Reference Spec Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Foundry Reference Spec Audit this skillaviggiano/security144—~495Automated safety check: PassMIT
SuperfluidLeoYeAI/openclaw-master-skills2.2k—~6.6kAutomated safety check: PassMIT
Fizz Convertpashov/skills1.2k2 repos~3.7kAutomated safety check: PassMIT
Feynman Auditor0xiehnnkta/nemesis-auditor2431 repos~11kAutomated safety check: PassMIT
Flounderadshao/flounder519—~9.2kAutomated safety check: PassAGPL-3.0
Smart Contract Auditgreatpie/smart-contract-audit-skill101—~1.1kAutomated safety check: PassNone

Similar skills

  • Superfluid

    LeoYeAI/openclaw-master-skills

    Knowledge base for the Superfluid Protocol and its ecosystem.

    2.2k GitHub stars~6.6k tokensUpdated 2 mo ago
    Documents & OfficeAuto-check passed

  • Fizz Convert

    pashov/skills

    Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.

    1.2k GitHub starsUsed in 2 repos~3.7k tokens
    Backend & APIsAuto-check passed

  • Feynman Auditor

    0xiehnnkta/nemesis-auditor

    Deep business logic bug finder using the Feynman technique. An agent skill from 0xiehnnkta/nemesis-auditor.

    243 GitHub starsUsed in 1 repo~11k tokens
    Backend & APIsAuto-check passed

  • Flounder

    adshao/flounder

    Operates Flounder, an autonomous white-hat security auditor.

    519 GitHub stars~9.2k tokensUpdated 3 days ago
    SecurityAuto-check passed

  • Smart Contract Audit

    greatpie/smart-contract-audit-skill

    Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.

    101 GitHub stars~1.1k tokensUpdated 7 mo ago
    Backend & APIsAuto-check passed

  • Radar

    Auditware/radar

    Use radar for smart contract security analysis, AST generation, and detection template development.

    154 GitHub stars~2.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

More from aviggiano/security

All 10 skills in this repo

  • Foundry Deploy Fixtures

    aviggiano/security

    Create or refactor Foundry deployment fixtures for Solidity tests.

    144 GitHub stars~634 tokensUpdated 23 days ago
    Auto-check passed

  • Foundry Fuzz Mirrors

    aviggiano/security

    Create Foundry fuzz tests from deterministic unit tests. An agent skill from aviggiano/security.

    144 GitHub stars~584 tokensUpdated 23 days ago
    Auto-check passed

  • Foundry Spec Properties

    aviggiano/security

    Turn whitepapers, protocol specs, and public documentation into Foundry property tests.

    144 GitHub stars~489 tokensUpdated 23 days ago
    Auto-check passed

  • Foundry Test Campaign

    aviggiano/security

    Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects.

    144 GitHub stars~1.6k tokensUpdated 23 days ago
    Auto-check passed

  • Stateful Invariant Testing

    aviggiano/security

    Build metric-driven Chimera/create-chimera-app stateful invariant testing campaigns for Solidity projects.

    144 GitHub stars~2.8k tokensUpdated 23 days ago
    Auto-check passed

  • Foundry Differential Tests

    aviggiano/security

    Create Foundry differential tests comparing production Solidity contracts against an independent reference model.

    144 GitHub stars~613 tokensUpdated 23 days ago
    Auto-check passed

Works with

Categories

Questions about Foundry Reference Spec Audit

What does Foundry Reference Spec Audit do?

Audit a Solidity reference implementation against a protocol whitepaper or public specification. Foundry Reference Spec Audit is an agent skill from aviggiano/security. Audit a Solidity reference implementation against a protocol whitepaper or public specification.

When should I use Foundry Reference Spec Audit?

Foundry Reference Spec Audit fits situations like: Codex needs to decide whether reference-model behavior; unsupported surfaces match the spec before creating; trusting Foundry differential tests.

How do I install Foundry Reference Spec Audit in Claude Code?

Run `npx skills add aviggiano/security --skill foundry-reference-spec-audit -a claude-code`. Or copy the skill folder (skills/foundry-reference-spec-audit in aviggiano/security) into .claude/skills/foundry-reference-spec-audit in your project. Claude Code loads it when a task matches its description.

How do I install Foundry Reference Spec Audit in Codex?

Run `npx skills add aviggiano/security --skill foundry-reference-spec-audit -a codex`. Or copy the skill folder (skills/foundry-reference-spec-audit in aviggiano/security) into .agents/skills/foundry-reference-spec-audit in your project. Codex loads it when a task matches its description.

Can I use Foundry Reference Spec Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aviggiano/security --skill foundry-reference-spec-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/foundry-reference-spec-audit, .gemini/skills/foundry-reference-spec-audit, .github/skills/foundry-reference-spec-audit and .opencode/skills/foundry-reference-spec-audit in your project.

What does Foundry Reference Spec Audit need to run?

SKILL.md names no scripts, command-line tools or credentials: Foundry Reference Spec Audit is instructions for the agent only.

Does Foundry Reference Spec Audit access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Foundry Reference Spec Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Foundry Reference Spec Audit use?

Foundry Reference Spec Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Foundry Reference Spec Audit use?

About 495 tokens (SKILL.md is roughly 2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Foundry Reference Spec Audit?

Skills that share tags, products or a category with Foundry Reference Spec Audit: Superfluid (LeoYeAI/openclaw-master-skills, 2.2k stars), Fizz Convert (pashov/skills, 1.2k stars), Feynman Auditor (0xiehnnkta/nemesis-auditor, 243 stars) and Flounder (adshao/flounder, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Foundry Reference Spec Audit?

aviggiano (a GitHub user) maintains it in aviggiano/security, which has 144 GitHub stars. The repository holds 10 skills in this directory. The repository was last updated on September 15, 2026.

Source: aviggiano/security on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.