Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lifinance/resolve-audit-issues
Work through an external auditor's GitHub issues for a contracts PR — discover the audit repo from Slack, load every finding, triage fix-vs-acknowledge in one gate, implement each fix as its own commit on a remediation branch, reply to each issue with "fixed <commit>" or "acknowledged <reason>", then post a Slack wrap-up nudging the auditor and pinging @smartcontract_core to re-review.
Passed 13 of 19 test cases with the skill, and 3 of 19 without it.
and 16 more in the full report
13 fixed2 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
Findings for an audit are located in repo `burrasec/lifi-bridge`. Which Slack channel and webhook environment variable should be used for the audit wrap-up message?
| Checked | Without skill | With skill |
|---|---|---|
| Selects #dev-sc-audit-burrasec as the target Slack channel. | Missed | Passed |
| Uses WEBHOOK_DEV_SC_AUDIT_BURRASEC as the webhook environment variable. | Missed | Passed |
The instructions your model reads when the skill loads.
Usage:
/resolve-audit-issues <PR_NUMBER_OR_URL_OR_FACET> [--audit-repo <owner/repo>]
An external auditor (Sujith, Burrasec) delivers findings as GitHub issues in their own repo, one issue per finding, severity-labelled. This command drives the response end to end: discover that repo, read every finding, decide per issue whether to fix or acknowledge, implement fixes one-commit-each on a fresh remediation branch, reply to each issue with a commit link or a reason, and post a Slack wrap-up nudging the auditor + pinging the SC team.
Control model — one gate. The command analyses all issues and presents a single triage table. You approve/edit the whole plan once. Then it executes autonomously, pausing only for (a) genuinely ambiguous findings it flagged, and (b) the mandatory pre-post review in Step 8.
One commit per fix (LI.FI convention: each finding fixed or acknowledged in isolation). Acknowledged findings produce no commit.
audit/auditLog.json → that's /add-audit, run later once
the auditor signs off on the fixes./multisig-rollout./request-audit.| Auditor | Channel | webhook --channel | env var | Auditor mention | Repo owner (typical) |
|---|---|---|---|---|---|
| Sujith Somraaj | #dev-sc-audit | dev-sc-audit | WEBHOOK_DEV_SC_AUDIT | <@U05GN6XH57T> | sujithsomraaj |
| Burrasec (Josip Koncurat) | #dev-sc-audit-burrasec | dev-sc-audit-burrasec | WEBHOOK_DEV_SC_AUDIT_BURRASEC | <@U094M720QDP> | burrasec / firm org |
The owner column is a hint, not a rule — always confirm the discovered repo with the user
before trusting it (Step 1). SC-team review tag: @smartcontract_core MUST be sent as
<!subteam^S096X6MCB0C> — a plain @… does not notify.
test cases passed, vs 3 / 19 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.