Agent skill

Foundry Test Campaign

by aviggiano in aviggiano/security

Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects.

MITAuto-check passedBackend & APIs

Install Foundry Test Campaign

skills CLI
$ npx skills add aviggiano/security --skill foundry-test-campaign -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aviggiano/security foundry-test-campaign --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aviggiano/security.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/foundry-test-campaign .claude/skills/foundry-test-campaign && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
foundry-test-campaign
GitHub stars
144
Token cost
~1.6k tokens
SKILL.md length
818 words
Files
2
Skills in repo
10
Repo updated
First seen
Licence
MIT

At a glance

Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects.

  • Works in 7 steps: Establish fixtures with… → Convert deterministic behavior into… → Add spec or whitepaper properties with… → …
  • Codex needs to create a goal and coordinate fixture setup
  • SKILL.md covers Purpose, Goal Mode, Pass Order and Fresh Context, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Foundry Test Campaign is an agent skill from aviggiano/security. Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects. Use when Codex needs to create a goal and coordinate fixture setup, fuzz tests, spec properties, reference implementations, differential tests, and independent failure triage until the testing objective is genuinely complete.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).

It sits in Backend & APIs, covering Smart contracts and End-to-end testing. It works with Solidity. The repository describes itself as: Security Reviews and Audit Checklists. The licence is MIT.

When your agent uses it

  • Codex needs to create a goal and coordinate fixture setup
  • Spec properties
  • Reference implementations
  • Differential tests

Example prompts

  • “/foundry-test-campaign”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Establish fixtures with foundry-deploy-fixtures.
  2. Convert deterministic behavior into parametric fuzz tests with foundry-fuzz-mirrors.
  3. Add spec or whitepaper properties with foundry-spec-properties.
  4. Build the independent reference model with foundry-reference-model.
  5. Audit the reference model against public specs with foundry-reference-spec-audit.
  6. Add production-vs-reference tests with foundry-differential-tests.
  7. Classify failures with foundry-failure-triage.

What it can do on your machine

Read from SKILL.md and the folder at commit e18ce7d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Foundry Test Campaign loads about 1.6k tokens when it runs. Until then it costs about 86 tokens; SKILL.md has 818 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~86
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aviggiano/security at commit e18ce7d, republished under its MIT licence (© aviggiano). 818 words, ~1,577 tokens.

Download SKILL.mdSave it as .claude/skills/foundry-test-campaign/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
foundry-test-campaign
description
Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects. Use when Codex needs to create a goal and coordinate fixture setup, fuzz tests, spec properties, reference implementations, differential tests, and independent failure triage until the testing objective is genuinely complete.

Foundry Test Campaign

Purpose

Use this as the master orchestration pass. Do not put every testing detail in one context. Create a concrete campaign goal when the user asks for an end-to-end testing effort, then run the focused Foundry skills in sequence until the objective is genuinely complete or blocked.

Goal Mode

When the user asks for a complete campaign, use a goal such as:

text
Build and validate a multi-pass Foundry fuzz, property, reference, and differential testing campaign for this Solidity project.

Keep the goal active across passes. Do not mark it complete after only planning, after only adding tests, or while unclassified failures remain. Complete the goal only when the requested campaign state is reached, validation has been run, and remaining failures are intentionally classified and reported.

Pass Order

  1. Establish fixtures with foundry-deploy-fixtures.
  2. Convert deterministic behavior into parametric fuzz tests with foundry-fuzz-mirrors.
  3. Add spec or whitepaper properties with foundry-spec-properties.
  4. Build the independent reference model with foundry-reference-model.
  5. Audit the reference model against public specs with foundry-reference-spec-audit.
  6. Add production-vs-reference tests with foundry-differential-tests.
  7. Classify failures with foundry-failure-triage.

Skip passes the repository has already done well. Do not rebuild a fixture layer only because later tests need a helper; extend the existing local pattern.

Fresh Context

Use fresh context for repeated judgment loops:

  • classifying failures
  • deciding whether a test is a harness defect
  • deciding whether to relax equality or add tolerance
  • reviewing reference-model behavior
  • comparing spec text to implementation behavior

When parallel agents are available and failures are independent, give each agent one failing test, the exact command or counterexample, the relevant public interface/spec input, and the classification rubric. Do not include the suspected answer unless validating a specific hypothesis.

Campaign Rules

  • Read AGENTS.md and scoped repository instructions before choosing a pass.
  • Use the focused subskill for the current pass; return to this master skill between passes to decide the next step.
  • Preserve strict equality unless the spec defines a tolerance.
  • Treat failing tests as useful findings. Do not fix production bugs by weakening tests.
  • Prefer deterministic tests before broad stateful fuzzing.
  • Keep reports tabular: failing test, category, root cause, recommendation.
  • Commit only focused, pass-scoped changes when asked to commit.

Production Bug Harvest

When the objective is scored by production bugs in ISSUES.md, optimize the campaign for independently classified, reproducible bug rows:

  • Keep a live candidate ledger while testing. For each red result, record the failing test or exact command, observed violation, current classification, suspected production root cause, duplicate link if any, and whether an ISSUES.md row has been written.
  • Favor breadth after reproducibility: once a strict reproducer is stable and the failure is plausibly production-side, classify and record it before spending time shrinking further, beautifying tests, or building broad new harness layers.
  • Keep every candidate bug tied to a strict red reproducer: a deterministic failing test is best; otherwise preserve the exact failing command, seed, calldata, inputs, and shrink notes needed to recreate the failure.
  • Do not delete, skip, relax, or over-tolerate a red test after it exposes plausible production behavior. Move or rename reproducers if needed, but keep them red until the issue is classified.
  • During bug harvest, do not patch production code, reference code, or assumptions merely to make a red reproducer pass. If a harness or reference fix is required to continue, first preserve any still-plausible production failure in the ledger with its original repro command.
  • Triage failures one at a time. Use fresh context or independent agents for unrelated failures, and classify each as production bug, harness/reference/spec defect, duplicate, or unresolved.
  • Deduplicate narrowly. Merge failures only when they share the same production root cause and remediation. Keep separate rows for distinct preconditions, call paths, violated invariants, accounting errors, access-control gaps, or remediation changes.
  • For every classified production bug, immediately add or update one ISSUES.md row with exactly these columns: id | Issue | Red tests | Root cause | Remediation. Preserve existing rows and choose the next stable id already used by the file; if the file is missing, create it with that header.
  • The Red tests cell must name the concrete failing test(s) or exact reproduction command. The Root cause cell must identify the production code behavior, not only the symptom. The Remediation cell must describe the production-side fix direction without weakening the test.
  • Do not route harness-only, reference-only, environment-only, or spec-uncertain failures into ISSUES.md as production bugs. Keep them in the final triage summary so they are not confused with missed production findings.
  • Before ending the goal, scan all failing tests, counterexamples, notes, candidate-ledger entries, and triage summaries. Ensure every non-duplicate classified production bug has a corresponding deduped ISSUES.md row, and report any unresolved red candidate separately rather than silently dropping it.
Show full SKILL.md (56 more words)Show less

Output

For a planning-only request, end with a concise pass list, the next skill to use, any directories that should contain new tests, and the first validation command.

For an end-to-end request, end with completed passes, files changed, validation commands, ISSUES.md production-bug row count, remaining classified failures, and whether the campaign goal is complete or blocked.

© aviggiano, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/foundry-test-campaign of aviggiano/security.

  • SKILL.md
  • agents/openai.yaml

Open the folder on GitHubat commit e18ce7d

Compare with similar skills

Foundry Test Campaign next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Foundry Test Campaign compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Foundry Test Campaign this skillaviggiano/security144—~1.6kAutomated safety check: PassMIT
Fizz Convertpashov/skills1.2k2 repos~3.7kAutomated safety check: PassMIT
Feynman Auditor0xiehnnkta/nemesis-auditor2431 repos~11kAutomated safety check: PassMIT
Smart Contract Auditgreatpie/smart-contract-audit-skill101—~1.1kAutomated safety check: PassNone
RadarAuditware/radar154—~2.1kAutomated safety check: PassGPL-3.0
Solidity AuditorGabson0x/bountyforge442—~3.7kAutomated safety check: PassNone

Similar skills

  • Fizz Convert

    pashov/skills

    Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.

    1.2k GitHub starsUsed in 2 repos~3.7k tokens
    Backend & APIsAuto-check passed
  • Feynman Auditor

    0xiehnnkta/nemesis-auditor

    Deep business logic bug finder using the Feynman technique. An agent skill from 0xiehnnkta/nemesis-auditor.

    243 GitHub starsUsed in 1 repo~11k tokens
    Backend & APIsAuto-check passed
  • Smart Contract Audit

    greatpie/smart-contract-audit-skill

    Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.

    101 GitHub stars~1.1k tokensUpdated 7 mo ago
    Backend & APIsAuto-check passed
  • Radar

    Auditware/radar

    Use radar for smart contract security analysis, AST generation, and detection template development.

    154 GitHub stars~2.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed
  • Solidity Auditor

    Gabson0x/bountyforge

    Security audit of Solidity code while you develop. An agent skill from Gabson0x/bountyforge.

    442 GitHub stars~3.7k tokensUpdated 23 days ago
    Backend & APIsAuto-check passed
  • Add Explorer

    lidofinance/diffyscan

    Adds or repairs Diffyscan explorer API routing and response adapters for a new host, chain or payload format.

    142 GitHub stars~1k tokensUpdated 4 days ago
    Backend & APIsAuto-check passed

More from aviggiano/security

All 10 skills in this repo
  • Foundry Deploy Fixtures

    aviggiano/security

    Create or refactor Foundry deployment fixtures for Solidity tests.

    144 GitHub stars~634 tokensUpdated 25 days ago
    Auto-check passed
  • Foundry Fuzz Mirrors

    aviggiano/security

    Create Foundry fuzz tests from deterministic unit tests. An agent skill from aviggiano/security.

    144 GitHub stars~584 tokensUpdated 25 days ago
    Auto-check passed
  • Foundry Spec Properties

    aviggiano/security

    Turn whitepapers, protocol specs, and public documentation into Foundry property tests.

    144 GitHub stars~489 tokensUpdated 25 days ago
    Auto-check passed
  • Stateful Invariant Testing

    aviggiano/security

    Build metric-driven Chimera/create-chimera-app stateful invariant testing campaigns for Solidity projects.

    144 GitHub stars~2.8k tokensUpdated 25 days ago
    Auto-check passed
  • Foundry Differential Tests

    aviggiano/security

    Create Foundry differential tests comparing production Solidity contracts against an independent reference model.

    144 GitHub stars~613 tokensUpdated 25 days ago
    Auto-check passed
  • Foundry Failure Triage

    aviggiano/security

    Classify failing Foundry fuzz, property, invariant, and differential tests.

    144 GitHub stars~637 tokensUpdated 25 days ago
    Auto-check passed

Works with

Categories

Questions about Foundry Test Campaign

What does Foundry Test Campaign do?

Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects. Foundry Test Campaign is an agent skill from aviggiano/security. Master skill for running an end-to-end multi-pass Foundry testing campaign for Solidity projects.

When should I use Foundry Test Campaign?

Foundry Test Campaign fits situations like: Codex needs to create a goal and coordinate fixture setup; spec properties; reference implementations; differential tests.

How do I install Foundry Test Campaign in Claude Code?

Run `npx skills add aviggiano/security --skill foundry-test-campaign -a claude-code`. Or copy the skill folder (skills/foundry-test-campaign in aviggiano/security) into .claude/skills/foundry-test-campaign in your project. Claude Code loads it when a task matches its description.

How do I install Foundry Test Campaign in Codex?

Run `npx skills add aviggiano/security --skill foundry-test-campaign -a codex`. Or copy the skill folder (skills/foundry-test-campaign in aviggiano/security) into .agents/skills/foundry-test-campaign in your project. Codex loads it when a task matches its description.

Can I use Foundry Test Campaign in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aviggiano/security --skill foundry-test-campaign -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/foundry-test-campaign, .gemini/skills/foundry-test-campaign, .github/skills/foundry-test-campaign and .opencode/skills/foundry-test-campaign in your project.

What does Foundry Test Campaign need to run?

SKILL.md names no scripts, command-line tools or credentials: Foundry Test Campaign is instructions for the agent only.

Does Foundry Test Campaign access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Foundry Test Campaign safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Foundry Test Campaign use?

Foundry Test Campaign is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Foundry Test Campaign use?

About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Foundry Test Campaign?

Skills that share tags, products or a category with Foundry Test Campaign: Fizz Convert (pashov/skills, 1.2k stars), Feynman Auditor (0xiehnnkta/nemesis-auditor, 243 stars), Smart Contract Audit (greatpie/smart-contract-audit-skill, 101 stars) and Radar (Auditware/radar, 154 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Foundry Test Campaign?

aviggiano (a GitHub user) maintains it in aviggiano/security, which has 144 GitHub stars. The repository holds 10 skills in this directory. The repository was last updated on September 15, 2026.

Source: aviggiano/security on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.