#729 by GitHub stars
pashov/skills
Pashov Audit Group Skills
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
fizz/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
eacfc09b365d → eacfc09b365d
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → eacfc09b365d
No earlier version was observed for comparison.
fizz/skills/fizz-convert/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
eacfc09b365d → eacfc09b365d
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → eacfc09b365d
No earlier version was observed for comparison.
fizz/skills/fizz-sync/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
eacfc09b365d → eacfc09b365d
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → eacfc09b365d
No earlier version was observed for comparison.
solidity-auditor/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
eacfc09b365d → eacfc09b365d
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → eacfc09b365d
No earlier version was observed for comparison.
x-ray/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
eacfc09b365d → eacfc09b365d
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → eacfc09b365d
No earlier version was observed for comparison.
Verified commit eacfc09b365d2697b83355909d0300607e596ffc
git clone --filter=blob:none --no-checkout https://github.com/pashov/skills.git .hotskills/pashov-skills && git -C .hotskills/pashov-skills checkout --detach eacfc09b365d2697b83355909d0300607e596ffc
# Copy each selected skill directory from .hotskills/pashov-skills into .claude/skills/<skill-name>/Heat
3.9- Star growth, last 7 daysAhead of 78% of tracked repositories
- Star growth, last 24 hoursAhead of 3% of tracked repositories
- Rank movement, last 7 daysAhead of 11% of tracked repositories
- Commits, last 30 daysAhead of 54% of tracked repositories
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekAhead of 0% of tracked repositories
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
Individual skills in this repository
- fizz
fizz - fizz-convert
fizz/skills/fizz-convert - fizz-sync
fizz/skills/fizz-sync - solidity-auditor
solidity-auditor - x-ray
x-ray
How it works
fizz
When your agent uses it
Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects. Trigger on "fizz", "generate fuzz suite", "build fuzz harness", "stateful fuzzing", "fuzzing harness", "property testing", and "invariant suite".
What it loads into context
Frontmatter
63 tokensAlways available to the agent
SKILL.md
10,683 tokensWhen the skill is activated
Reference documents
23,892 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Workflow Rules
- Parameters
- Run Mode
- Subagent Model
- Step 0: Print Banner
- Step 1: Verify Tooling And Environment
- Step 2: Compile And Extract
- Step 3: Understand The Protocol
- Step 4: Select Entry Points
- Step 4.5: Cost Estimate
- Step 5: Generate Scaffold
- Step 6: Modify Core Files And Wire Setup
- Step 7: Generate Handlers
- Step 8: Reach Coverage With Medusa
- Step 9: Generate Invariants (5 Parallel Discovery Agents + Synthesizer + 2 Implementers)
- Step 10: Run Campaigns
- Step 11: Validate And Report
Scripts executed separately
scripts/ensure_foundry.shscripts/estimate_cost.jsscripts/extract_abis.jsscripts/fizz_sync.jsscripts/generate_handlers.jsscripts/generate_suite.jsscripts/lib/log-viewer.jsscripts/run_echidna.jsscripts/run_medusa.jsscripts/select_functions.jsscripts/setup_fuzz_profile.sh
Files
README.mddoc1,504 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesSKILL.mdcore45,129 bytesVERSIONasset2 bytesagents/implementers/global-property-implementer.mddoc4,096 bytesagents/implementers/specific-property-implementer.mddoc5,447 bytesagents/invariant-discovery/adversarial-profit-maximizer.mddoc6,618 bytesagents/invariant-discovery/conservation-auditor.mddoc5,052 bytesagents/invariant-discovery/protocol-type-specialist.mddoc8,492 bytesagents/invariant-discovery/roundtrip-rounding-analyst.mddoc7,634 bytesagents/invariant-discovery/state-transition-mapper.mddoc4,658 bytesagents/invariant-discovery/synthesizer.mddoc15,737 bytesagents/protocol-analyzer.mddoc5,600 bytesagents/report-writer.mddoc8,781 bytesevals/evals.jsonasset731 bytesreferences/handler-patterns.mddoc10,239 bytesreferences/property-generation.mddoc5,555 bytesreferences/selection-policy.mddoc2,292 bytesreferences/setup-playbook.mddoc3,789 bytesreferences/template-map.mddoc7,224 bytesscripts/ensure_foundry.shruns4,402 bytesscripts/estimate_cost.jsruns6,233 bytesscripts/extract_abis.jsruns11,484 bytesscripts/fizz_sync.jsruns29,129 bytesscripts/generate_handlers.jsruns14,665 bytesscripts/generate_suite.jsruns9,752 bytesscripts/lib/log-viewer.jsruns11,626 bytesscripts/run_echidna.jsruns6,454 bytesscripts/run_medusa.jsruns12,514 bytesscripts/select_functions.jsruns23,163 bytesscripts/setup_fuzz_profile.shruns5,007 bytestemplates/Actor.solasset2,027 bytestemplates/Base.solasset4,689 bytestemplates/FoundryTester.solasset949 bytestemplates/FuzzTester.solasset245 bytestemplates/Properties.solasset886 bytestemplates/README.mddoc2,116 bytestemplates/Snapshots.solasset618 bytestemplates/echidna.yamlasset599 bytestemplates/handlers/Handlers.solasset413 bytestemplates/medusa.jsonasset2,189 bytestemplates/utils/Clamp.solasset7,547 bytestemplates/utils/DecimalPrinter.solasset1,892 bytestemplates/utils/Deployer.solasset530 bytestemplates/utils/EnumerableSet.solasset6,040 bytestemplates/utils/Hevm.solasset2,258 bytestemplates/utils/Logger.solasset14,359 bytestemplates/utils/Math.solasset1,693 bytestemplates/utils/MockERC20.solasset10,385 bytestemplates/utils/PropertiesAsserts.solasset7,455 bytestemplates/utils/StringUtils.solasset3,484 bytes
Read SKILL.md
# Fizz
Generate a stateful Solidity fuzz suite under `{SUITE_DIR}` (default: `test/fizz/`), with metadata and fuzzer runtime files under `{META_DIR}` (default: `fizz_data/`).
Use `Echidna` and `Medusa` for invariant campaigns. Use `Foundry` for compilation, smoke testing, and quick debugging.
## Workflow Rules
- Follow the steps in order. Do not skip forward if a required artifact for the current step does not exist yet.
- If a step fails, stop there and report the blocker.
- If tooling is missing, say exactly what was attempted and what is missing.
- Keep the generated Solidity suite isolated under `test/fizz/` and the metadata/runtime files under `fizz_data/` unless the user explicitly asks for different paths.
- Reuse existing project setup and test logic whenever possible; do not invent a deployment flow if the repo already has one.
View the complete source on GitHubfizz-convert
When your agent uses it
Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes. Trigger on "fizz-convert", "convert properties", "implement properties from PROPERTIES.md", "convert PROPERTIES.md to Solidity".
What it loads into context
Frontmatter
68 tokensAlways available to the agent
SKILL.md
3,616 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Parameters
- Checkbox states and how they map to actions
- STEP 1: READ CURRENT STATE
- STEP 1.5: RECONCILE SPEC WITH CODE
- STEP 2: IDENTIFY PROPERTIES TO CONVERT
- STEP 3: PLAN EACH IMPLEMENTATION
- STEP 4: APPLY EDITS
- STEP 5: BUILD
- STEP 6: REPORT
Files
SKILL.mdcore14,695 bytesSKILL.mdcore14,695 bytesSKILL.mdcore14,695 bytesSKILL.mdcore14,695 bytes
Read SKILL.md
# Property Conversion Skill — fizz-convert
You are an expert Solidity fuzzing engineer working inside a project that was set up by the **Fizz** skill. Your job is to convert English-language properties in `PROPERTIES.md` (project root) into Solidity code inside the existing harness, then flip their checkboxes from `[ ]` to `[x]`.
**Arguments**: optional space-separated property IDs (e.g., `GL-01 SP-03`) passed when the user invokes the skill. If no IDs are given, convert ALL properties currently marked `[ ]`.
## Parameters
- `SUITE_DIR`: Solidity suite directory relative to project root (default: `test/fizz`). Use the same value that was passed to the `fizz` skill when the harness was generated.
- `META_DIR`: Metadata directory relative to project root (default: `fizz_data`). Use the same value that was passed to the `fizz` skill.
## Checkbox states and how they map to actions
`PROPERTIES.md` uses three states. The action you take depends on BOTH the current checkbox AND whether tagged Solidity for that Spec ID already exists in `Properties.sol` / handlers.View the complete source on GitHubfizz-sync
When your agent uses it
Reconcile an existing Fizz harness with a changed source tree. Detects added/removed/changed contract functions, quarantines stale properties, regenerates drifted handler stubs, and refreshes the snapshot. Trigger on "fizz-sync", "resync fuzzing", "sync fuzz harness", "refresh fuzzing properties", "fuzzing drift check".
What it loads into context
Frontmatter
80 tokensAlways available to the agent
SKILL.md
3,689 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to use
- Parameters
- Arguments
- Preconditions
- STEP 0: REBUILD CURRENT ABIS
- STEP 1: HANDLE --init
- STEP 2: RUN THE DRIFT REPORT
- STEP 3: DRY-RUN SUMMARY (ALWAYS)
- STEP 4: APPLY — HANDLER REGENERATION
- STEP 5: APPLY — PROPERTY QUARANTINE
- STEP 6: REBUILD AND VALIDATE
- STEP 7: REFRESH SNAPSHOT
- STEP 8: REPORT
- RULES
Scripts executed separately
../../scripts/extract_abis.js../../scripts/fizz_sync.js
Files
../../scripts/extract_abis.jsruns11,484 bytes../../scripts/fizz_sync.jsruns29,129 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytesSKILL.mdcore15,592 bytes
Read SKILL.md
# Fizz Sync Skill — fizz-sync
Reconcile a project previously processed by the **Fizz** skill with a changed source tree. This is the re-use entry point: after the user modifies Solidity sources, `fizz-sync` detects drift, quarantines stale properties, regenerates drifted handler stubs, and refreshes the snapshot — WITHOUT re-running the full 11-step pipeline.
## When to use
- The source contracts under `src/` changed since `fizz` last ran.
- A property in `PROPERTIES.md` fails to compile or references a function that no longer exists.
- The user added new external functions they want fuzzed.
- The user wants a "is anything stale?" health check before re-running a campaign.
## Parameters
- `SUITE_DIR`: Solidity suite directory relative to project root (default: `test/fizz`). Use the same value that was passed to the `fizz` skill when the harness was generated.View the complete source on GitHubsolidity-auditor
When your agent uses it
Security audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security", "loop mode", "run the auditor in loop mode", "run 3 passes". Modes - default (full repo) or a specific filename. Loop mode runs several passes in one scan, each pass told what the earlier ones found, and ends in one combined report; it remembers findings between scans in a ledger.
What it loads into context
Frontmatter
97 tokensAlways available to the agent
SKILL.md
10,357 tokensWhen the skill is activated
Reference documents
29,680 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Mode Selection
- Orchestration
- Banner
Scripts executed separately
references/assemble.sh
Files
README.mddoc1,568 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesSKILL.mdcore42,337 bytesVERSIONasset4 bytesreferences/agent-prompts.mddoc5,680 bytesreferences/assemble.shruns16,718 bytesreferences/dedup-and-assembly.mddoc33,062 bytesreferences/hacking-agents/access-control-agent.mddoc1,865 bytesreferences/hacking-agents/asymmetry-agent.mddoc4,685 bytesreferences/hacking-agents/boundary-agent.mddoc6,470 bytesreferences/hacking-agents/economic-security-agent.mddoc2,557 bytesreferences/hacking-agents/execution-trace-agent.mddoc2,747 bytesreferences/hacking-agents/first-principles-agent.mddoc2,049 bytesreferences/hacking-agents/flow-gap-agent.mddoc5,844 bytesreferences/hacking-agents/invariant-agent.mddoc4,381 bytesreferences/hacking-agents/math-precision-agent.mddoc3,884 bytesreferences/hacking-agents/numerical-gap-agent.mddoc5,179 bytesreferences/hacking-agents/periphery-agent.mddoc3,370 bytesreferences/hacking-agents/shared-rules.mddoc3,377 bytesreferences/hacking-agents/trust-gap-agent.mddoc4,011 bytesreferences/judging.mddoc5,025 bytesreferences/report-formatting.mddoc19,772 bytesreferences/report-language.mddoc7,384 bytesreferences/senior-auditor-sop.mddoc4,130 bytes
Read SKILL.md
# Smart Contract Security Audit
You are the orchestrator of a parallelized smart contract security audit.
## Mode Selection
**Exclude pattern:** skip **dependency and build directories** — `node_modules/`, `lib/`, `artifacts/`, `cache/`, `out/`, `broadcast/`, `coverage/`, `typechain*/` — and **non-production code** — `interfaces/`, `mocks/`, `test/` and files matching `*.t.sol`, `*Test*.sol` or `*Mock*.sol`.
**Deploy scripts stay in scope.** `script/`, `deploy/` and `*.s.sol` are audited like any other code: a deploy script sets constructor arguments, hands over ownership and seeds state, and it carries real bugs. Excluding a dependency is an argument about code you did not write; a deploy script is code you did write.
- **Default** (no arguments): scan all `.sol` files using the exclude pattern. Use Bash `find` (not Glob), exactly this command:
```bash
find . -type f -name '*.sol' \View the complete source on GitHubx-ray
When your agent uses it
Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping), invariants, integrations, docs quality, test analysis, and developer/git history. Triggers on 'x-ray', 'audit readiness', 'readiness report', 'pre-audit report', 'prep this protocol', 'protocol prep', 'summarize this protocol'.
What it loads into context
Frontmatter
99 tokensAlways available to the agent
SKILL.md
9,550 tokensWhen the skill is activated
Reference documents
21,246 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Progress tracking (MANDATORY)
- Step 1: Enumerate & Measure
- Step 2: Read Source Files + Entry Point Scan (SINGLE message, ALL tool calls parallel)
- Step 3: Write Output
- Constraints
Scripts executed separately
scripts/analyze_git_security.pyscripts/entry_points.pyscripts/enumerate.shscripts/generate_svg.py
Files
README.mddoc1,497 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesSKILL.mdcore41,360 bytesVERSIONasset4 bytesreferences/templates.mddoc46,695 bytesreferences/threats.mddoc48,186 bytesscripts/analyze_git_security.pyruns49,224 bytesscripts/entry_points.pyruns10,825 bytesscripts/enumerate.shruns9,074 bytesscripts/generate_svg.pyruns34,177 bytes
Read SKILL.md
# X-Ray
Generate an `x-ray/` folder at the project root containing all output files. Pipeline: 3 steps, always sequential.
`$SKILL_DIR` = the directory containing this SKILL.md file. Resolve it from the path you loaded this skill from (e.g. if this file is at `/path/to/x-ray/SKILL.md`, then `$SKILL_DIR` = `/path/to/x-ray`).
## Progress tracking (MANDATORY)
Before doing anything else, call TodoWrite with these 3 todos (all `pending`):
1. `Phase 1: Enumerate & measure codebase`
2. `Phase 2: Read sources, classify entry points, synthesize invariants`
3. `Phase 3: Write x-ray report files`
View the complete source on GitHubSkills included
- fizz
- fizz-convert
- fizz-sync
- solidity-auditor
- x-ray
Repository facts
- License
- MIT
- Created
- Feb 23, 2026
- Last pushed
- Oct 21, 2026
- Forks
- 242
- Open issues
- 2
- Project activity
- Active
Rank over the last 12 weeks
Now #729 · best #535 · down 95 in 30 days
- #717 on Nov 1
- #718 on Nov 2
- #722 on Nov 3
- #725 on Nov 4
- #727 on Nov 5
- #729 since Nov 6
73 earlier periods
- #523 on Aug 2
- #520 on Aug 7
- #515 on Aug 8
- #521 on Aug 9
- #535 on Aug 10
- #537 from Aug 11 to Aug 12
- #538 on Aug 13
- #537 on Aug 14
- #522 on Aug 15
- #535 on Aug 16
- #539 on Aug 17
- #556 on Aug 18
- #545 from Aug 19 to Aug 20
- #549 on Aug 21
- #536 on Aug 22
- #554 on Aug 23
- #558 on Aug 24
- #568 on Aug 25
- #556 on Aug 26
- #571 on Aug 27
- #577 on Aug 28
- #569 on Aug 31
- #574 on Sep 1
- #570 on Sep 2
- #571 on Sep 3
- #552 on Sep 4
- #548 on Sep 5
- #562 on Sep 6
- #567 on Sep 7
- #584 on Sep 8
- #579 on Sep 10
- #568 on Sep 11
- #568 on Sep 13
- #590 on Sep 14
- #587 from Sep 16 to Sep 17
- #595 on Sep 18
- #588 on Sep 20
- #592 on Sep 21
- #599 on Sep 22
- #592 on Sep 23
- #571 on Sep 24
- #564 on Sep 25
- #563 on Sep 26
- #584 on Sep 27
- #588 on Sep 28
- #611 on Sep 29
- #596 on Sep 30
- #587 on Oct 2
- #567 on Oct 3
- #589 on Oct 5
- #601 on Oct 6
- #603 on Oct 7
- #634 on Oct 8
- #620 on Oct 9
- #603 on Oct 10
- #622 on Oct 12
- #621 on Oct 13
- #631 on Oct 14
- #624 on Oct 15
- #633 on Oct 16
- #615 on Oct 17
- #607 on Oct 18
- #635 on Oct 19
- #645 on Oct 20
- #649 on Oct 21
- #631 on Oct 22
- #629 on Oct 23
- #616 on Oct 24
- #696 on Oct 25
- #703 on Oct 28
- #707 on Oct 29
- #710 on Oct 30
- #714 on Oct 31
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 3, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 85 notes
fizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedfizz/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 10 dangerous shell commandsin 7 files: fizz/scripts/setup_fuzz_profile.sh:72 fizz/scripts/fizz_sync.js:404 fizz/SKILL.md:134 and 4 more
- 61 network referencesin 21 files: fizz/SKILL.md:98 fizz/scripts/lib/log-viewer.js:45 fizz/scripts/ensure_foundry.sh:18 and 18 more
- No hidden or obfuscated text
- No instruction overrides
- 18 executable scriptsin 16 files: fizz/scripts/extract_abis.js:1 fizz/scripts/fizz_sync.js:1 fizz/scripts/ensure_foundry.sh:1 and 13 more
- No access to secrets
- No requests to vote in Hot
Show all 89 signals by file
fizz/README.md
- Network accessline 30
Install https://github.com/pashov/skills/ and run fizz on the codebase
fizz/SKILL.md
- Network accessline 98
2. Run `forge --version`. 3. If `forge --version` fails, tell the user that Foundry is missing and suggest installing it using the official documentation: Foundry install guide: `https://www.getfoundry.sh/introduction/installation` - Network accessline 99
3. If `forge --version` fails, tell the user that Foundry is missing and suggest installing it using the official documentation: Foundry install guide: `https://www.getfoundry.sh/introduction/installation` 4. If `forge --version` fails, - Network accessline 100
Foundry install guide: `https://www.getfoundry.sh/introduction/installation` - Network accessline 105
8. Run `echidna --version`. 9. If either command fails, tell the user which tool is missing and suggest installing it using the official documentation: Medusa install guide: `https://secure-contracts.com/program-analysis/medusa/docs/src/ - Network accessline 106
9. If either command fails, tell the user which tool is missing and suggest installing it using the official documentation: Medusa install guide: `https://secure-contracts.com/program-analysis/medusa/docs/src/getting_started/installation - Network accessline 107
Medusa install guide: `https://secure-contracts.com/program-analysis/medusa/docs/src/getting_started/installation.html` - Network accessline 108
Echidna install guide: `https://secure-contracts.com/program-analysis/echidna/introduction/installation.html` - Dangerous shell operationline 134
Before Attempt 1, delete `/tmp/x-ray-attempts.md` if it exists (`rm -f /tmp/x-ray-attempts.md`) — stale entries from a previous run would falsely satisfy the Attempt 4 gate. Then create a fresh `/tmp/x-ray-attempts.md` and append one entry - Network accessline 139
git clone --depth 1 https://github.com/pashov/skills.git /tmp/pashov-skills-xray-install \
fizz/scripts/ensure_foundry.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 18
echo "" echo "Install Foundry:" echo " curl -L https://foundry.paradigm.xyz | bash" - Network accessline 19
echo "Install Foundry:" echo " curl -L https://foundry.paradigm.xyz | bash" echo " foundryup" - Dangerous shell operationline 20
echo " curl -L https://foundry.paradigm.xyz | bash" - Network accessline 20
echo " curl -L https://foundry.paradigm.xyz | bash" - Network accessline 21
echo " foundryup" echo "" echo "Or see: https://www.getfoundry.sh/introduction/installation" - Network accessline 22
echo "" echo "Or see: https://www.getfoundry.sh/introduction/installation" exit 1 - Network accessline 23
echo "Or see: https://www.getfoundry.sh/introduction/installation"
fizz/scripts/estimate_cost.js
- Executable scriptline 1
#!/usr/bin/env node
fizz/scripts/extract_abis.js
fizz/scripts/fizz_sync.js
fizz/scripts/generate_handlers.js
- Executable scriptline 1
#!/usr/bin/env node
fizz/scripts/generate_suite.js
- Executable scriptline 1
#!/usr/bin/env node
fizz/scripts/lib/log-viewer.js
- Executable scriptline 1
Executable file - Network accessline 45
return new Promise((resolve) => { const server = http.createServer((req, res) => { const requestURL = new URL(req.url, 'http://127.0.0.1'); - Network accessline 47
const requestURL = new URL(req.url, 'http://127.0.0.1'); - Network accessline 74
server.listen(0, '127.0.0.1', () => { const address = server.address(); const viewerURL = `http://127.0.0.1:${address.port}`; - Network accessline 76
const viewerURL = `http://127.0.0.1:${address.port}`; - Network accessline 306
async function poll() { try { const response = await fetch('/log?offset=' + offset, { cache: 'no-store' }); - Network accessline 307
try { const response = await fetch('/log?offset=' + offset, { cache: 'no-store' }); const payload = await response.json(); - Network accessline 308
const response = await fetch('/log?offset=' + offset, { cache: 'no-store' });
fizz/scripts/run_echidna.js
- Executable scriptline 1
#!/usr/bin/env node
fizz/scripts/run_medusa.js
- Executable scriptline 1
#!/usr/bin/env node
fizz/scripts/select_functions.js
- Executable scriptline 1
#!/usr/bin/env node - Network accessline 500
try { const res = await fetch(SERVER_URL + '/save', { - Network accessline 501
const res = await fetch(SERVER_URL + '/save', { - Network accessline 612
server.listen(0, () => { const port = server.address().port; serverURL = `http://127.0.0.1:${port}`; - Network accessline 613
const port = server.address().port; serverURL = `http://127.0.0.1:${port}`; console.log(`\nFunction selector running at ${serverURL}`); - Network accessline 614
serverURL = `http://127.0.0.1:${port}`;
fizz/scripts/setup_fuzz_profile.sh
fizz/templates/echidna.yaml
- Network accessline 18
# https://secure-contracts.com/program-analysis/echidna/configuration.html
fizz/templates/utils/Clamp.sol
- Network accessline 7
/// @author Modified from Crytic (https://github.com/crytic/properties/blob/main/contracts/util/PropertiesAsserts.sol)
fizz/templates/utils/Deployer.sol
- Network accessline 4
// Source: https://solidity-by-example.org/app/deploy-any-contract/
fizz/templates/utils/EnumerableSet.sol
- Network accessline 5
/** * @dev Library for managing * https://en.wikipedia.org/wiki/Set_(abstract_data_type)[sets] of primitive - Network accessline 6
* @dev Library for managing * https://en.wikipedia.org/wiki/Set_(abstract_data_type)[sets] of primitive * types. - Network accessline 7
* https://en.wikipedia.org/wiki/Set_(abstract_data_type)[sets] of primitive - Network accessline 31
* Trying to delete such a structure from storage will likely result in data corruption, rendering the structure * unusable. * See https://github.com/ethereum/solidity/pull/11843[ethereum/solidity#11843] for more info. - Network accessline 32
* unusable. * See https://github.com/ethereum/solidity/pull/11843[ethereum/solidity#11843] for more info. * - Network accessline 33
* See https://github.com/ethereum/solidity/pull/11843[ethereum/solidity#11843] for more info.
fizz/templates/utils/Hevm.sol
- Network accessline 4
// source: https://github.com/crytic/properties/blob/main/contracts/util/IHevm.sol
fizz/templates/utils/Math.sol
- Network accessline 4
/// @author Modified from Forge standard lib (https://github.com/foundry-rs/forge-std/blob/master/src/StdMath.sol)
fizz/templates/utils/MockERC20.sol
- Network accessline 27
/// @notice Sets `amount` as the allowance of `spender` over the caller's tokens. /// @dev Be aware of front-running risks: https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729 - Network accessline 28
/// @dev Be aware of front-running risks: https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729 - Network accessline 45
/// @notice This is a mock contract of the ERC20 standard for testing purposes only, it SHOULD NOT be used in production. /// @notice Includes open deal function to mint tokens to any address. /// @dev Forked from: https://github.com/trans - Network accessline 46
/// @notice Includes open deal function to mint tokens to any address. /// @dev Forked from: https://github.com/transmissions11/solmate/blob/0384dbaaa4fcb5715738a9254a7c0a4cb62cf458/src/tokens/ERC20.sol contract MockERC20 is IERC20 { - Network accessline 47
/// @dev Forked from: https://github.com/transmissions11/solmate/blob/0384dbaaa4fcb5715738a9254a7c0a4cb62cf458/src/tokens/ERC20.sol
fizz/templates/utils/PropertiesAsserts.sol
- Network accessline 6
/// @author Modified from Crytic (https://github.com/crytic/properties/blob/main/contracts/util/PropertiesAsserts.sol)
fizz/templates/utils/StringUtils.sol
- Network accessline 4
/// @notice Efficient library for creating string representations of integers. /// @author Solmate (https://github.com/transmissions11/solmate/blob/main/src/utils/LibString.sol) - Network accessline 5
/// @author Solmate (https://github.com/transmissions11/solmate/blob/main/src/utils/LibString.sol) - Network accessline 6
/// @author Modified from Solady (https://github.com/Vectorized/solady/blob/main/src/utils/LibString.sol)
solidity-auditor/README.md
- Network accessline 22
Install https://github.com/pashov/skills/ and run solidity auditor on the codebase
solidity-auditor/SKILL.md
- Network accessline 65
c. ToolSearch `select:Agent` d. Read the local `VERSION` file from the same directory as this skill e. Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/solidity-auditor/VERSION` - Network accessline 66
d. Read the local `VERSION` file from the same directory as this skill e. Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/solidity-auditor/VERSION` f. Bash `mktemp -d ./.audit-XXXXXX` → store as `{bundle_dir}` - Network accessline 67
e. Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/solidity-auditor/VERSION` - Network accessline 94
If the remote VERSION fetch succeeds, compare the two as **numbers** and warn **only when the local one is lower**: print `⚠<U+FE0F> You are not using the latest version. Please upgrade for best security coverage. See https://github.com/pashov/ski
solidity-auditor/references/assemble.sh
- Executable scriptline 1
#!/usr/bin/env bash - Dangerous shell operationline 39
trap 'rm -rf "$work"' EXIT - Network accessline 348
rule say "> ⚠<U+FE0F> This review was performed by an AI assistant. AI analysis can never verify the complete absence of vulnerabilities and no guarantee of security is given. Team security reviews, bug bounty programs, and on-chain monitoring are - Network accessline 349
say "> ⚠<U+FE0F> This review was performed by an AI assistant. AI analysis can never verify the complete absence of vulnerabilities and no guarantee of security is given. Team security reviews, bug bounty programs, and on-chain monitoring are stro
solidity-auditor/references/dedup-and-assembly.md
- Dangerous shell operationline 414
5. **Auto-clean.** `rm -rf {bundle_dir}`. Bundle dir = transient build state, not an artifact. Don't skip. It runs once per scan, at any pass count, and it runs when the loop stopped early too. For debugging a loop: copy the bundle elsewher
solidity-auditor/references/report-formatting.md
- Network accessline 158
> ⚠<U+FE0F> This review was performed by an AI assistant. AI analysis can never verify the complete absence of vulnerabilities and no guarantee of security is given. Team security reviews, bug bounty programs, and on-chain monitoring are strongly
x-ray/README.md
- Network accessline 32
Install latest https://github.com/pashov/skills/ and run x-ray on the codebase
x-ray/SKILL.md
- Network accessline 41
**0. Version check** (foreground): - Read the local `VERSION` file from `$SKILL_DIR/VERSION` - Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/x-ray/VERSION` - Network accessline 42
- Read the local `VERSION` file from `$SKILL_DIR/VERSION` - Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/x-ray/VERSION` - If the remote VERSION fetch succeeds and differs from local, print `⚠<U+FE0F> You are not using the la - Network accessline 43
- Bash `curl -sf https://raw.githubusercontent.com/pashov/skills/main/x-ray/VERSION` - Network accessline 44
- If the remote VERSION fetch succeeds and differs from local, print `⚠<U+FE0F> You are not using the latest version. Please upgrade for best security coverage. See https://github.com/pashov/skills`. If it fails, skip silently.
x-ray/references/templates.md
- Dangerous shell operationline 715
rm -f x-ray/architecture.json x-ray/git-security-analysis.json /tmp/architecture-preview.png
x-ray/scripts/analyze_git_security.py
- Executable scriptline 1
#!/usr/bin/env python3
x-ray/scripts/entry_points.py
- Executable scriptline 1
#!/usr/bin/env python3
x-ray/scripts/enumerate.sh
- Executable scriptline 1
#!/bin/bash
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 2 facts
- Dangerous shell operation in prose of the SKILL.mdfizz/SKILL.md:134Low confidence
- Network access in code of the SKILL.mdfizz/SKILL.md:139High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Path CLAUDE.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md fizz/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md fizz/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md fizz/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md fizz/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md fizz/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
Explore alternatives and comparisons
Add this badge to your README
It updates every night and links to this page.
[](https://hotskills.dev/skill/pashov-skills/)