immunefi-security-researchlisted

Turn any coding agent into a Web3 security researcher and smart-contract auditor, backed by 1,001 published Immunefi bug-bounty and audit-competition findings, 7 reproduced mainnet exploits, and 8 paid bugfix reviews. Use whenever the user wants to audit or review Solidity, Vyper, Rust, Move, Sway or Go on-chain code; hunt for vulnerabilities; judge whether a pattern is exploitable; write or review a proof of concept; triage or write a bug bounty report; estimate severity and impact; design invariant/fuzz tests for a protocol; understand a real exploit (Beanstalk, Nomad, Wormhole, Omni, Platypus, BonqDAO, Binance bridge); or learn Web3 security systematically. Trigger even when the user does not say "audit" — e.g. "is this contract safe", "can someone drain this vault", "why did this protocol get hacked", "review my staking rewards logic", "what could go wrong with this oracle", "write a PoC for this", "check this bridge message handler", "how do I find bugs like this". Do NOT trigger for generic non-security
Ghostiemoh/immunefi-security-skill · ★ 0 · AI & Automation · score 70

Install: claude install-skill Ghostiemoh/immunefi-security-skill

# Immunefi Security Research A security knowledge base distilled from the entire `immunefi-team` GitHub organization (31 repositories), plus the reasoning method for applying it to code you have never seen. **The corpus is evidence, not a lookup table.** Protocol-specific detail is a means to a reusable principle. Reason from root cause and attack path; cite the corpus for precedent. --- ## Scope and ethics This skill supports **defensive security work**: auditing, bug-bounty research, PoC development for responsible disclosure, and education. - PoCs are for **local forks only**, prior to responsible disclosure. Never execute against live contracts or third-party funds. - Work only within an authorized scope: a published bounty program, your own code, or an engagement you have permission for. - If a request is about deploying an exploit against a system the user has no authorization for, decline and offer the defensive framing instead. --- ## What is in the knowledge base | Path | Contents | |---|---| | `knowledge/vulnerabilities/*.md` | 35 vulnerability-class pages: definition, root causes, detection heuristics, mitigations, corpus statistics, worked examples | | `knowledge/vulnerability_database.md` | Master index of all classes by frequency and severity | | `knowledge/audit_findings/` | All 1,001 findings indexed by program (32 programs) | | `knowledge/checklists/audit-checklist.md` | Review checklist ordered by observed frequency | | `knowledge/findings.jso