Hire an AI blockchain security reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A scope list: every contract in scope, its size and its external dependencies.
• An invariant list: what must always hold, and where it could break.
• A findings table: each issue, its severity (critical to informational), the attack scenario and the fix.
• A methodology note saying what was checked by reading the code versus what still needs a tool like Slither or a fuzzer.

How it does the job well

• Review only the code given. Never assume a function is safe because it looks like it uses a known-safe library (such as OpenZeppelin) without checking how it's used.
• Never mark a finding Informational to soften it. If it can lose user funds, it is High or Critical.
• Check the full call chain of each function in scope, including inherited contracts and internal calls, not just the function the user is worried about.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Reviewing a whole protocol in one pass when the user could scope it to one or two contracts for a sharper result.
• Copying the profile's sample findings (the reentrancy or oracle examples in its reference file) as if they were found in the user's code.
• Skipping the manual read because the user says a scanner already ran. Scanners miss logic and economic bugs.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You're about to deploy a contract that holds or moves user funds and want a structured review first.

• Scope. Every contract in scope, its size and the external dependencies it calls into.
• Invariants. What must always hold in the protocol, and where the code could let that break.
• Findings. Each issue by severity, with its location, attack scenario and a specific fix.
• Methodology. What was checked by reading the code, and what still needs a tool like Slither or a fuzzer.
• Assumptions and checks. What the agent assumed and which facts you still need to confirm.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Scope the contracts. It lists every contract in scope, its size, and the external calls, oracles and protocols it depends on.
• List the invariants. It states what must always hold, such as a share-to-asset ratio, and where the contract could let that break.
• Check known exploit classes. It walks reentrancy, access control, oracle manipulation and flash loan attack paths against the actual code, not a checklist.
• Classify by value at risk. Each finding gets a severity from critical (funds lost with no special access) to informational, based on real impact.
• Write the audit plan. Each finding gets a location, an attack scenario and a specific fix, plus what still needs a tool like Slither to confirm.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-blockchain-security-auditor only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-blockchain-security-auditor/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The contracts in scope, pasted or attached, and what the protocol is supposed to do.
• The invariants you believe must always hold, such as "total shares times price equals total assets" (optional, but it sharpens the review).
• Any external dependencies: price oracles, bridges, other protocols you call into.
• Past audit reports or known issues, if you have them (optional).

Helpful context (optional)

• Your test suite or Foundry invariant tests, if you have them.
• The protocol's whitepaper or spec.
• Any Slither or Mythril output you already have.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read the full contract source next to your description of what the protocol does.

Functions and deliverables

• Blockchain security reviewer: Paste your smart contract scope. Get an audit plan with reentrancy, oracle and access-control checks, ranked by how much user money is at risk.
  • A scope list: every contract in scope, its size and its external dependencies.
  • An invariant list: what must always hold, and where it could break.
  • A findings table: each issue, its severity (critical to informational), the attack scenario and the fix.
  • A methodology note saying what was checked by reading the code versus what still needs a tool like Slither or a fuzzer.
  Source: Michael Sitarzewski and Agency Agents contributors.
• Code change security reviewer: Check a code diff for security risks. Paste your pull request and get ranked findings on only the changed lines, each with a fix.
  • A verdict: safe, fix first or look closer
  • Findings with the line, the abuse and the level
  • The smallest fix for each
  • What was not checked
• Django access control reviewer: Trace who can read, change or delete Django data. Get supported access-control findings, enforcement fixes and clearly marked gaps in the review.
  • A summary of how authorization works in your code
  • Confirmed access control gaps
  • The code path behind each finding
  • A suggested fix for each gap
  Source: sickn33.
• Oracle migration risk reviewer: Check Oracle to PostgreSQL migration work against 14 known behavior gaps and get a risk table, test coverage check and pass or fail verdict.
  • A table with one row per risk that applies to your code
  • For each risk, the affected file and the fix to apply
  • A note on any risk that needs a design decision from you
  • A check of whether your tests cover each risk
  • A pass or fail checklist
  Source: GitHub Copilot community.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You're about to deploy a contract that holds or moves user funds and want a structured review first.
• You changed a lending, AMM or vault contract and want the invariants re-checked, not just the diff.
• You're adding a price oracle or a new external dependency and want to know what it exposes.
• You want a plan to brief a paid audit firm with, so the engagement starts from known risks, not from zero.

Limits to check before starting

• You need a full, paid audit before deploying funds-holding contracts. This plan is a starting point, not a substitute for a licensed audit firm.
• You're reviewing a traditional web app or API with no on-chain contracts. Use the Security Architect or Application security reviewer.
• Your contracts are already live and under active attack. Get your team and an incident response firm on it now; this agent plans reviews, it doesn't respond to live exploits.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.
• Paste the contracts in scope and say what the protocol does, in plain words.
• Name the invariants you expect to hold, and any oracle or external protocol you depend on.
• Say "Build the audit plan. Flag anything you could not verify without running a tool."
• Read the findings table first. Any Critical or High finding should block deployment until it's fixed and re-checked.
• Take the finished plan to a licensed audit firm before you deploy funds-holding contracts.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-blockchain-security-auditor for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.