Skip to content

Back to the catalog

pashov/skills
github.comrepo

pashov/skills

pashov/skills is a set of Claude Code "skills" built by Pashov Audit Group that turn an AI coding agent into a Solidity security auditor: an "x-ray" command for quick codebase reconnaissance, a "solidity auditor" mode that runs multiple different agent personas over a codebase (or specified files) looking for vulnerabilities, and a "fizz" command for additional automated checks. It packages smart-contract audit tradecraft into reusable AI agent skills rather than a standalone scanner, letting developers or auditors invoke deep, multi-pass Solidity review directly inside their coding assistant.

TL;DR Claude Code skills that turn an AI agent into a multi-persona Solidity security auditor (x-ray, auditor, fizz).
Document

What it is

pashov/skills is a repository of Claude Code skills from Pashov Audit Group for Solidity security review. It is MIT licensed and takes pull requests under a CONTRIBUTING.md process. The three skills are x-ray, solidity auditor and fizz. The page gives no install step beyond pointing the agent at the repository URL.

What to do

The README drives everything through plain-language prompts to the agent. To install and run in one step, use one of these:

Install https://github.com/pashov/skills/ and run an x-ray on the codebase
Install https://github.com/pashov/skills/ and run solidity auditor with all different agents possible on the codebase
Install https://github.com/pashov/skills/ and run fizz on the codebase

Once the skills are installed, the shorter prompts are:

run an x-ray on the codebase
run the solidity auditor with all the different agents possible on *specified files*
run fizz on the codebase
update skills to latest version

The auditor prompt can be scoped to specific files instead of the whole codebase. The last prompt updates the installed skills.

Caveats

The page does not describe what each agent checks, what output format to expect, how long a run takes or what it costs. It reports no benchmarks or detection rates, and it does not say what fizz checks beyond running it on the codebase. Pashov Audit Group offers a Telegram contact (@pashovkrum) for broader security strategy, and vulnerabilities in the repository go through its Security Policy.

Organisations named here

  • Pashov Audit Group

Technologies named here

  • pashov/skills
  • x-ray
  • solidity auditor
  • fizz
  • Claude Code
  • Solidity
  • Ethereum