{
 "schema": "aiblocks-page/1",
 "id": "agency-security-blockchain-security-auditor",
 "type": "agent",
 "name": "Blockchain security reviewer",
 "summary": "Paste your smart contract scope. Get an audit plan with reentrancy, oracle and access-control checks, ranked by how much user money is at risk.",
 "headline": "Blockchain security reviewer",
 "subhead": "Give it the contracts in scope and what the protocol is meant to do. It checks each one against known exploit patterns, such as reentrancy and oracle manipulation, and hands back a ranked audit plan with the invariants to verify.",
 "job": {
  "id": "secure-code",
  "name": "Keep your code secure"
 },
 "level": "intermediate",
 "thinking": "high",
 "tested": true,
 "updated": "2026-11-03",
 "first_published": "2026-10-26",
 "inputs": [
  {
   "type": "codebase",
   "required": true,
   "label": "Codebase",
   "what": "a project's code, in a folder or repo the AI can open"
  },
  {
   "type": "question",
   "required": false,
   "label": "Question",
   "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like"
  }
 ],
 "outputs": [
  {
   "type": "security_report",
   "required": true,
   "label": "Security report",
   "what": "the risks found in the code, ranked, each with a fix"
  }
 ],
 "you_give": [
  "The contracts in scope, pasted or attached, and what the protocol is supposed to do.",
  "The invariants you believe must always hold, such as \"total shares times price equals total assets\" (optional, but it sharpens the review).",
  "Any external dependencies: price oracles, bridges, other protocols you call into.",
  "Past audit reports or known issues, if you have them (optional)."
 ],
 "you_get": [
  "A scope list: every contract in scope, its size and its external dependencies.",
  "An invariant list: what must always hold, and where it could break.",
  "A findings table: each issue, its severity (critical to informational), the attack scenario and the fix.",
  "A methodology note saying what was checked by reading the code versus what still needs a tool like Slither or a fuzzer."
 ],
 "use_when": [
  "You're about to deploy a contract that holds or moves user funds and want a structured review first.",
  "You changed a lending, AMM or vault contract and want the invariants re-checked, not just the diff.",
  "You're adding a price oracle or a new external dependency and want to know what it exposes.",
  "You want a plan to brief a paid audit firm with, so the engagement starts from known risks, not from zero."
 ],
 "skip_when": [
  "You need a full, paid audit before deploying funds-holding contracts. This plan is a starting point, not a substitute for a licensed audit firm.",
  "You're reviewing a traditional web app or API with no on-chain contracts. Use the Security Architect or Application security reviewer.",
  "Your contracts are already live and under active attack. Get your team and an incident response firm on it now; this agent plans reviews, it doesn't respond to live exploits."
 ],
 "output_sample": {
  "input": [
   "The contracts in scope, pasted or attached",
   "What the protocol is supposed to do, in plain words",
   "The invariants you expect to hold (optional)",
   "Any oracle or external protocol dependency (optional)"
  ],
  "prerequisites": [
   "An AI that can read files, if you attach contract source"
  ],
  "output": [
   {
    "name": "Scope",
    "contains": "Every contract in scope, its size and the external dependencies it calls into."
   },
   {
    "name": "Invariants",
    "contains": "What must always hold in the protocol, and where the code could let that break."
   },
   {
    "name": "Findings",
    "contains": "Each issue by severity, with its location, attack scenario and a specific fix."
   },
   {
    "name": "Methodology",
    "contains": "What was checked by reading the code, and what still needs a tool like Slither or a fuzzer."
   },
   {
    "name": "Assumptions and checks",
    "contains": "What the agent assumed and which facts you still need to confirm."
   }
  ]
 },
 "output_shape": "SCOPE\n  <contract> | <lines of code> | <external dependencies>\n\nINVARIANTS\n  <invariant> | <where it could break>\n\nFINDINGS (by severity)\n  [Critical/High/Medium/Low/Informational] <title> | <location> | <attack scenario> | <fix>\n\nMETHODOLOGY\n  Checked by reading: <list>\n  Still needs a tool (Slither, Mythril, Echidna or a fuzzer): <list>\n\nASSUMPTIONS AND CHECKS STILL NEEDED\n  <assumption or gap> | <what to verify>",
 "how_to_use": [
  "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.",
  "Paste the contracts in scope and say what the protocol does, in plain words.",
  "Name the invariants you expect to hold, and any oracle or external protocol you depend on.",
  "Say \"Build the audit plan. Flag anything you could not verify without running a tool.\"",
  "Read the findings table first. Any Critical or High finding should block deployment until it's fixed and re-checked.",
  "Take the finished plan to a licensed audit firm before you deploy funds-holding contracts."
 ],
 "checks": [
  "The result addresses your actual task and cites the evidence used.",
  "Examples, role-play experience and targets are kept separate from verified results.",
  "Claims of tests, memory, tool access or completed actions match what actually happened."
 ],
 "next": [
  {
   "name": "AI agent attack tester",
   "url": "https://useaiblocks.com/skills/ai-agent-attack-tester",
   "why": "AI agent attack tester"
  },
  {
   "name": "Prompt injection defender",
   "url": "https://useaiblocks.com/skills/prompt-injection-defender",
   "why": "Prompt injection defender"
  }
 ],
 "source": {
  "by": "Michael Sitarzewski and Agency Agents contributors",
  "repo": "msitarzewski/agency-agents",
  "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-blockchain-security-auditor.md",
  "licence": "MIT",
  "original_name": "Blockchain Security Auditor",
  "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219"
 },
 "credits": [
  {
   "title": "Blockchain Security Auditor",
   "by": "Michael Sitarzewski and Agency Agents contributors",
   "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-blockchain-security-auditor.md",
   "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions."
  }
 ],
 "files": [
  "LICENSE",
  "references/source-agent.md",
  "SETUP.md",
  "source.json"
 ],
 "links": {
  "page": "https://useaiblocks.com/agents/agency-security-blockchain-security-auditor",
  "markdown": "https://useaiblocks.com/agents/agency-security-blockchain-security-auditor.md",
  "json": "https://useaiblocks.com/agents/agency-security-blockchain-security-auditor.json",
  "instructions": "https://useaiblocks.com/skills/agency-security-blockchain-security-auditor/SKILL.md",
  "download": "https://useaiblocks.com/skills/agency-security-blockchain-security-auditor.zip",
  "api_item": "https://useaiblocks.com/api/v1/items/agency-security-blockchain-security-auditor",
  "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-blockchain-security-auditor",
  "mcp": "https://useaiblocks.com/mcp"
 }
}