evm-audit-cli

What This Skill Does

The evm-audit-cli skill is a specialized, lightweight AI-driven tool designed to perform security audits on Solidity smart contracts. Unlike resource-heavy alternatives that require containerization like Docker, this skill functions as a direct command-line interface. It reads your local Solidity source files, leverages advanced AI models via OpenRouter (such as GPT-4o-mini or Claude 3.5 Sonnet), and generates actionable security reports. By focusing on local file analysis, it provides a fast, privacy-conscious workflow for developers looking to catch common vulnerabilities early in the development lifecycle without needing to rely on external block explorers or complex environments.

Installation

To begin using this skill, ensure you have an active OpenRouter API key. Run the following command via the ClawHub CLI to add the tool to your OpenClaw environment:

clawhub install openclaw/skills/skills/aviclaw/evm-audit-cli

Once installed, set your environment variable to authenticate the API requests:

export OPENROUTER_API_KEY=your_openrouter_api_key_here

Use Cases

This skill is perfect for:

1. Rapid iterative auditing during the development process to catch low-hanging fruit like reentrancy or integer overflows.
2. Developers who need an audit solution that doesn't rely on bloated Docker containers.
3. Quick assessment of smart contract logic when prototyping or learning Solidity patterns.
4. CI/CD integration where lightweight, fast AI analysis is preferred over full static analysis suites.

Example Prompts

1. "Run an audit on the Solidity files located in the ./src/contracts directory using the default model."
2. "Perform a security audit on ./contracts/Vault.sol and provide the output in JSON format for my report."
3. "Audit my contract using the claude-3.5-sonnet model to get a more comprehensive analysis of complex logic."

Tips & Limitations

While powerful, it is crucial to remember that this tool performs AI-based analysis rather than formal verification. AI models can hallucinate or overlook sophisticated logic errors. Always treat the findings as suggestions. For a production-ready security posture, you should pair this skill with manual audits and static analysis tools like Slither. Furthermore, ensure you only audit local, non-sensitive environments, and always review the generated report manually before deploying any code to a live mainnet or testnet blockchain.