Superteam Brasil v7.6.0 Core pack of the kit
Auditor Skill
A full audit firm inside your agent: Solana programs and every line of code around them.
17 commands9 agents 20 checklists 140 known attack vectors ★ 61
Superteam Brasil Official skills
Official skills from
Superteam Brasil
Superteam Brasil builds and maintains these skills as part of the Solana AI Kit. They are open source and MIT-licensed. Each one is mirrored here at a pinned commit, with every skill, subskill and reference file on its own URL as markdown, ready to copy or hand to an agent.
- Skills
- 2
- Subskills, commands and agents
- 38
- Markdown files hosted
- 345
- Contributors
- 8
Superteam Brasil Kit add-on pack
Startup Builder
The non-program half of shipping on Solana: idea, positioning, pricing, pitch, fundraising, launch.
12 skills 76 reference files ★ 2
Auditor Skill
OpenIntake, threat model, item-by-item checklists, known attack vectors, executable proofs of concept and fix patches, then a report your team can ship. It covers Anchor and Pinocchio programs plus TypeScript, Python, Go, Rust services, CI/CD and AI agents, and works post-incident too: /auditor:hunt and /auditor:respond read transaction history and program logs.
auditor:audit-assist Flow B — AI-assisted iterative audit with a human in the loop. Same lifecycle as audit-cycle, but pauses at checkpoints to surface confirmed findings, the next-focus plan, and targeted questions only the human can answer (business context, trust model, severity calls). The human steers; the agent re-synthesizes toward the audit document. Open .md
auditor:audit-cycle Flow A — fully automated audit-firm lifecycle. Runs scope → context → tool-assisted first pass → domain-partitioned manual review → independent reconciliation → client report end-to-end, and delivers a professional audit report (MD + optional PDF). Audit-shaped automation, not a substitute for a human firm audit. Open .md
auditor:audit-report Aggregate audit checkpoints into the final report — executive summary, Scope Coverage, findings by severity, maturity scorecard, and remediation roadmap. Open .md
auditor:audit Full scope-gated security audit of a Solana / full-stack repository — discovery, context reconstruction, per-item checklist verdicts, false-positive validation, and a severity-ranked report. Open .md
auditor:deep-review Deep single-instruction / single-function security review using the instruction worksheet, context reconstruction, and adversarial exploit modeling. Open .md
auditor:diff-audit PR / commit-scoped differential audit — audits only changed functions (plus 1-hop callers) and the published-code delta of changed dependencies, flags removed security checks, and prioritizes by risk × blast radius. Open .md
auditor:economic-sim Quantify a candidate economic finding — compute attack cost vs extractable value and, when possible, reproduce deposit→manipulate→withdraw against a Surfpool mainnet-fork for a real P/L figure. Open .md
auditor:hunt Post-incident threat hunt for when no alert has fired: baseline a Solana program's transaction history and program logs, record each hypothesis and its query in a ledger, check each suspect against the source deployed at the incident slot, replay the attack locally on the real program bytes, and write incident_<n>/INCIDENTS.json and INCIDENT_REPORT.md. Proposes only; never signs, sends, or acts on-chain. Open .md
auditor:intake Interactive engagement intake (alias /scope). Walks QUESTIONS.md and persists the answers to audit_<n>/intake.md — the durable intake artifact both audit-cycle and audit-assist read, instead of answers living only in conversation state. Captures scope + commit pin, languages/frameworks, protocol class, compliance, severity calibration, the trust-model inputs that feed the report's Trust Model and Assumptions sections, and the execution mode for target-controlled code (OUTPUT-RULES Rule 11a). Interactive mode asks; automated mode records the applied default. Open .md
auditor:patch Draft and verify a fix for a confirmed finding — a MINIMAL idiomatic unified diff against the pinned audited commit, applied to a scratch worktree and proven by re-running the finding's PoC (it must now revert). Proposal only; the auditor stays read-only on the client tree. Optional mutation + blast-radius evidence. Emits [FIX-VERIFIED] / [FIX-INSUFFICIENT] / [FIX-PROPOSED]. Open .md
auditor:poc Generate an executable proof-of-concept exploit for a confirmed High/Critical finding — detect the toolchain, pick the harness framework by finding type, spawn poc-engineer, and emit a one-command runnable crate plus the earned [PoC-*] evidence tier. Never hard-fails: on toolchain absence it downgrades to [PoC-ATTEMPTED] and keeps the existing prose PoC. Open .md
auditor:quick-scan Fast security triage — discovery + static analysis + the highest-severity vector subset, without the full item-by-item walk. Use for a first look or a CI gate. Open .md
auditor:re-audit Fix-review / re-audit. Takes a prior audit report + the current tree and classifies every prior finding FIXED / PARTIALLY-FIXED / STILL-OPEN / REGRESSED / ACKNOWLEDGED / DISPUTED (re-running Rule 5b on the fix, citing the remediation commit/PR hash), audits the changed surface for NEW findings via the diff-audit path, and runs a sibling-patch-propagation sweep for un-patched copies of every fixed anti-pattern. Emits a finding-diff. Open .md
auditor:respond Investigate one incident lead (a transaction signature, an address, an alert, an indicator of compromise, or an INC id from /auditor:hunt) through Solana transaction history — work out whether the attack landed and how far it reached, pin the root cause in the deployed code and reproduce it locally, then draft containment, remediation and recovery steps for humans to carry out. This command changes nothing on-chain. Open .md
auditor:spec-audit Spec-vs-code compliance audit — extracts requirements from a spec / whitepaper / RFC and matches each to the implementation with typed verdicts. Open .md
auditor:threat-model Builds the pre-review threat model as audit_<n>/threat-model.md — an asset inventory (crown-jewel funds/authority/data and where they live), an actor x capability table (each actor → what they can do → what they must NOT be able to do), and a trust-boundary map (which CPIs/accounts/inputs cross a trust boundary). No verdicts — attacker-goal enumeration that seeds report §4.4/§4.6/§4.7 and gives vuln-hunter/economic-analyst concrete goals to falsify. Automated flow drives it via the threat-modeler agent; interactive flow asks the human. --bootstrap also seeds goals from git history, a fork parent, prior audits, post-mortems and incidents, each cited in an Evidence column. Open .md
auditor:triage Re-runnable batch triage checkpoint over the candidate finding set (fixes triage being diffused across agents). Dedups by root-cause signature (reusing /re-audit's signature idea; audit-mem auto-suppresses prior-ruled false positives and flags regressions when built), enforces Rule 5b calibration (every N≥6 carries its validation block or is downgraded to [UNCONFIRMED]/[UNDETERMINED], with any economic/reachability downgrade quantified per the false-positives "quantify the barrier" rule), and splits real security findings (severity 1–10) from the Notes & Nitpicks list. Emits a triaged finding set plus a suppression appendix recording what was withheld and why. Open .md
audit-reporter Deterministic report assembly — aggregates verdicts and findings, builds the Scope Coverage table, severity rollup, maturity scorecard, and remediation roadmap. No code reasoning; keeps report generation cheap. Open .md
context-builder Builds architectural understanding before any verdict — runs Phase 0 setup and Phase 0.5 Context Reconstruction, producing the instruction matrix, state model, and per-function worksheets. Spawned first in a full audit. Open .md
economic-analyst Owns checklist 06 (economic & logic) and the economic known-vectors — flash loans, first-depositor, MEV, oracle manipulation, reward accounting. Drives economic simulation to quantify profitability. Open .md
incident-responder Does all reading and analysis of the incident corpus for /auditor:hunt and /auditor:respond — profiles a Solana transaction corpus, keeps the hypothesis ledger, scopes a lead, verdicts whether an attack succeeded, quantifies blast radius, and writes incident_<n>/INCIDENTS.json plus the incident report or a proposed (never executed) response plan. Proposes containment, never performs it. Open .md
patch-engineer Drafts a minimal idiomatic unified diff that closes exactly the cited bound, then verifies it by re-running the finding's PoC against a scratch worktree — the exploit must now revert. Optional mutation + blast-radius evidence. Emits [FIX-VERIFIED] / [FIX-INSUFFICIENT] / [FIX-PROPOSED]; never claims FIX-VERIFIED without an executed revert. Open .md
peer-reviewer Independent reconciliation reviewer — the dual-review second pass. Takes the top-severity confirmed findings and re-derives each one from the code (not from the primary's write-up), reusing the context worksheets to avoid re-reconstruction. Emits CONFIRM / DISPUTE / DOWNGRADE per finding; a DISPUTE forces the finding back through Rule 5b or to [UNCONFIRMED]. Scoped to top-severity only to bound cost. Open .md
poc-engineer Given a confirmed finding + its context worksheet, produces the smallest self-contained crate that reproduces the flaw — feature-gated vulnerable/fixed arms, asserting the exploit succeeds on the vulnerable arm and is rejected on the fixed arm. Emits the [PoC-*] evidence tier; downgrades to [PoC-ATTEMPTED] + prose on any blocker, never fabricates a passing test. Open .md
threat-modeler Builds the pre-review threat model before any verdict — asset inventory, actor x capability table, and trust-boundary map — reconstructed from the code and the context worksheets, and in bootstrap mode seeded from the collector's history output (git history, fork parent, prior audits, post-mortems, incidents). Drives /auditor:threat-model in a full audit, analogous to how context-builder drives Phase 0.5. No verdicts; attacker-goal enumeration only. Open .md
Startup Builder
OpenTwelve skills for the work a small team hits around the code. They chain through files in .claude/context/: run idea-sprint and build-status first, and the deck, the data room and the launch post all quote the same numbers instead of re-interviewing you.
build-status Capture what is built, deployed and used into .claude/context/build.md — program IDs, verified build, audit state, what works today, and traction with the query behind each number. Use before a deck, hackathon submission, grant or investor update, or when asked "what have we shipped". Open .md
ecosystem-bd Get a Solana product listed, routed and integrated by others (Jupiter, wallets, explorers, DefiLlama, Superteam, Foundation): a dated map of what each surface requires, readiness gaps, two-way diligence and the partner ask. Use for "get listed on Jupiter", "partnerships", "integration BD". Open .md
fundraising Fundraising beyond the deck for a crypto team - data room index, diligence questions with honest answers, investor updates, token-vs-equity orientation. Writes .claude/context/data-room.md. Use for "data room", "due diligence", "investor update", "token and equity". Open .md
hackathon Prepare a winning hackathon submission. Use when the user says "hackathon submission", "submit to hackathon", "demo script", "demo video", "which track should I enter", "Colosseum", "help me win the hackathon", or asks about hackathon grants and Superteam Earn. Open .md
idea-sprint Find and validate what to build in crypto. Use when the user asks "what should I build", "validate this idea", "is this worth building", "find me a startup idea", "crypto idea", or wants blunt feedback on a project concept before writing code. Open .md
incident-comms Tell users about a Solana product incident (failing txs, paused program, broken upgrade, exploit) with a severity ladder tied to onchain state, pre-written updates, an HTML status page and a user-facing postmortem. Use for "incident", "outage", "status page", "exploit comms" or "postmortem". Open .md
launch Plan and run a Solana launch day as a runbook gated on the onchain event (deploy, mint, TGE, liquidity add, audit release), with T-minus gates, slip and abort rules, channel order and pre-staged copy. Use for "/launch", "launch day plan", "announcement sequence" or "the deploy slipped". Open .md
market-sizing Size the market bottom-up with a source on every number, and rank entry wedges by problem quality × how much each builds the vision. Writes .claude/context/market.md. Use for "TAM", "market size", "market slide", "beachhead", "wedge", "where do we start". Open .md
pitch-deck Build a pitch deck for a crypto project. Use when the user says "pitch deck", "demo day", "investor presentation", "grant application slides", "accelerator application", "help me pitch", or needs slides for a hackathon final. Open .md
pitch-review Blind-test a deck, spoken script or pitch video before it goes out - answer key first, anonymized copy, readers with no context, ranked against decks that raised - and write .claude/context/review.md. Use for "review my deck", "is the deck clear", "blind review", "pitch feedback". Open .md
positioning Write the one-liner, ICP with disqualifiers, job to be done, three named alternatives and proof points once, into .claude/context/positioning.md, so the deck, site, docs and launch post say the same thing. Use for "positioning", "ICP", "who is this for", "value prop", "how do we describe this". Open .md
pricing Decide what an onchain product charges and how it is packaged - fee surface, payer, number, floor-cost math, comparables, falsification test - and write .claude/context/pricing.md. Use for "what should we charge", "protocol fee", "bps", "take rate", "token-gated tier", "pricing page". Open .md
One install for the whole kit
Superteam Brasil builds these skills as part of the Solana AI Kit, its open-source Claude Code and Codex kit for Solana. 15 specialist agents, 32 commands, 4 MCP servers and 46 skill packs, behind a firewall that keeps agents away from wallet keypairs.
- Specialist agents
- 15
- Commands
- 32
- Skill packs
- 46
- MCP servers
- 4
$ curl -fsSL https://aikit.superteam.codes | bash