audit-prep-assistant

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, code-quality, documentation, security, testing.

What it does

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill audit-prep-assistant

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/audit-prep-assistant ~/.claude/skills/audit-prep-assistant

Safety box score

Grade B, low risk: 18 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a prep-and-documentation assistant for codebases before external security review. Its main risks come from running local analysis/test tooling and making repository changes such as cleanup, branch/tag creation, dependency locking, and generated documentation; it does not itself include remote publishing or privilege escalation.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs local tools like `slither . --exclude-dependencies`, `dylint --all`, `golangci-lint run`, `forge build`, `forge test`, and `forge coverage`, which execute code on the user's machine.
Network access	0 (none)	The skill text does not instruct downloading from or sending data to remote hosts; the listed commands are local analysis and test commands.
Filesystem reach	2 (moderate)	It can write and reorganize repository content by generating docs, removing dead code, documenting files in scope, and creating a dedicated branch/tag and dependency lock state; all are repo-scoped but real filesystem changes.
Secrets & credentials	0 (none)	There is no request to read tokens, keys, browser sessions, `.env` files, or other credential stores.
Privilege & persistence	0 (none)	No `sudo`, global install, service registration, or OS/shell configuration changes are requested.
Instruction hijack surface	0 (none)	The skill contains no instructions to ignore policies, hide actions, follow fetched instructions, or otherwise manipulate the agent's behavior beyond normal task guidance.
Irreversible actions	1 (low)	It recommends preparatory actions like creating a branch, tagging a release version, and documenting accepted risks, but it does not itself push, deploy, publish, or delete anything remotely.
Transparency	0 (none)	The shipped files are plain text YAML/Markdown/SVG; there are no binaries, encoded payloads, or runtime-downloaded installers.

Before installing

Read `SKILL.md` and confirm you want a tool that runs linters/tests on your codebase.
Use a scratch branch or disposable clone first, since it may create docs, tags, and dependency-lock changes.
Check whether your project already has the required analyzers installed (`slither`, `dylint`, `golangci-lint`, Foundry).
Decide which generated files you want kept (`ARCHITECTURE.md`, `USER_STORIES.md`, `GLOSSARY.md`) before letting it run.

Rated 2026-10-20 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md
Branch: main
Collection: building-secure-contracts
Updated: 2026-09-19

code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.