Add simao-audit-pipeline accounting-first audit skill - #7
Open
ccashwell wants to merge 3 commits into
Open
Conversation
Vendor 0xSimao's accounting-first audit methodology (github.com/0xsimao/0xsimao-ai, VERSION 1.0.0) as a new EVM Cortex skill. The orchestrator builds a money map (assets, tracked totals, asymmetry table, invariants, lifecycles, cohorts) then runs 12 parallel single-specialty lenses over it, deduplicates through four hard gates, and emits severity-classified findings with Foundry PoCs for Highs. The references/ subdirectory (method, severity calibration, report formatting, 12 attack lenses + shared rules) is carried over from upstream intact. EVM Cortex adaptations — agent mapping, Foundry pre-flight, PoC routing to security-verifier/ poc-writer — live in SKILL.md only, so an upstream re-sync replaces references/ without merge conflicts. Mirrors the vendoring pattern used by pashov-audit-pipeline. Register the skill across CLAUDE.md (AUDIT PIPELINE + SKILL REFERENCE), README.md (skill count 94->95, Audit table, credits), AGENTS.md audit-mindset guidance, and the UPGRADING.md changelog. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TF42TqHLPE7NVhSuupswX7
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d25ffd58e7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The OpenClaw installer only installs skills, never rules, so RULE_COUNT (copied over from install.sh) was dead. shellcheck flags it as SC2034 and CI runs with -S warning, failing the Validate job. Remove the line. Pre-existing on main; unrelated to the simao-audit-pipeline skill addition, fixed here to get this PR's CI green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TF42TqHLPE7NVhSuupswX7
Five fixes from the PR #7 review: - PoC ordering (P1): reorder Turn 6 so High PoCs are constructed and verified before the report is formatted and before the bundle dir is deleted. Previously the addendum routed PoC construction "after Turn 6", which could never land in the printed report. - Completeness vs rejected leads (P1): the completeness gate no longer forces a gate-rejected lead's (Contract, function) back into the report. Every raw tuple must be accounted for as reported / rejected-with-reason / merged — not necessarily reported. - Marker verification (P2): Turn 5 now greps each lens's output for the four mandatory reasoning markers and re-runs or down-weights a lens that scanned instead of reasoned, matching what shared-rules.md promises. - --file-output destination (P2): define the report path in SKILL.md ({project}-simao-audit-report-{timestamp}.md in cwd) since the vendored report-formatting.md specifies content, not path. - onchain spelling (P1): normalize the one "on-chain" in the vendored access-trust.md to the repo-required "onchain"; note the deviation in SKILL.md, README.md, and UPGRADING.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TF42TqHLPE7NVhSuupswX7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vendor 0xSimao's accounting-first audit methodology (github.com/0xsimao/0xsimao-ai,
VERSION 1.0.0) as a new EVM Cortex skill. The orchestrator builds a money map
(assets, tracked totals, asymmetry table, invariants, lifecycles, cohorts) then
runs 12 parallel single-specialty lenses over it, deduplicates through four hard
gates, and emits severity-classified findings with Foundry PoCs for Highs.
The references/ subdirectory (method, severity calibration, report formatting,
12 attack lenses + shared rules) is carried over from upstream intact. EVM Cortex
adaptations — agent mapping, Foundry pre-flight, PoC routing to security-verifier/
poc-writer — live in SKILL.md only, so an upstream re-sync replaces references/
without merge conflicts. Mirrors the vendoring pattern used by pashov-audit-pipeline.
Register the skill across CLAUDE.md (AUDIT PIPELINE + SKILL REFERENCE), README.md
(skill count 94->95, Audit table, credits), AGENTS.md audit-mindset guidance, and
the UPGRADING.md changelog.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01TF42TqHLPE7NVhSuupswX7