{"slug":"zealynxsecurity-assess","name":"assess","description":"Full audit readiness assessment against Zealynx security framework. Goes check-by-check through every framework check for your vertical. Produces .zealynx-run.json for import into audit-readiness.zealynx.io.","long_description":"---\nname: assess\ndescription: >\n Full audit readiness assessment against Zealynx security framework.\n Goes check-by-check through every framework check for your vertical.\n Produces .zealynx-run.json for import into audit-readiness.zealynx.io.\nargument-hint: \" [--config key=val,...] [--project ]\"\ndisable-model-invocation: true\nallowed-tools: Read, Grep, Glob, Bash, Write\n---\n\n# Krait Full Assessment\n\nYou are Krait, running a complete audit readiness assessment. You will analyze every check in the framework for the user's vertical, producing structured output compatible with audit-readiness.zealynx.io.\n\nThis is the thorough mode. Unlike `/krait:scan` (quick findings), this produces a complete assessment with a verdict for EVERY check.\n\n## Parse Arguments\n\nParse `$ARGUMENTS` for:\n- **vertical** (required, first positional arg): e.g., `lending`, `vaults`, `dasf` (DEX/AMM in some user-facing copy), `staking`, `bridges`, `perpetuals`, etc.\n- **--config key=val,key=val**: project configuration overrides:\n - `oracle=none|chainlink|custom` (default: unknown)\n - `admin=ownable|roles|multisig|immutable` (default: unknown)\n - `hasFlashLoans=true|false` (default: false, lending only)\n - `dexType=uniswap-v2|uniswap-v3-cl|uniswap-v4-hooks|custom` (dasf only)\n - `lendingType=pool-based|isolated|peer-to-peer|custom` (lending only)\n - `chains=ethereum,arbitrum,...` (comma-separated)\n- **--project **: project name (default: directory name)\n\nIf no vertical is provided, tell the user:\n```\nUsage: /krait:assess [--config key=val,...] [--project ]\n\nAvailable verticals: lending, vaults, dasf, staking, bridges, stablecoins,\nperpetuals, leverage, eigenlayer, layerzero, chainlink, dao, airdrop, vesting,\nnft, vrf, gaming, common, and 20+ more.\n\nSee the full list: Read ${CLAUDE_SKILL_DIR}/references/check-index.md\n```\nThen stop.\n\n## Step 1: Discover and Read Code\n\nSame as /krait:scan — find all .sol files, read the source files (not tests/scripts/libs).\n\n```\nGlob for **/*.sol\n```\n\nExclude: `node_modules/`, `lib/`, `forge-std/`, `test/`, `script/`, `mock/`, `Mock*.sol`, `*.t.sol`, `*.s.sol`\n\nRead ALL source files. You MUST actually read them.\n\nGet the current git commit hash:\n```bash\ngit rev-parse --short HEAD 2>/dev/null || echo \"unknown\"\n```\n\n## Step 2: Load Framework\n\nLoad the SCAN-TIER framework JSON for the specified vertical (includes promptTemplate + mitigation but drops bulky references to save context):\n\n```\nRead ${CLAUDE_SKILL_DIR}/frameworks/scan/.json\n```\n\nThis contains:\n```json\n{\n \"label\": \"Lending / Borrowing\",\n \"version\": \"3.0.0\",\n \"totalChecks\": 41,\n \"checks\": [\n {\n \"id\": \"LN-01\",\n \"q\": \"Is your collateral validation implemented securely?\",\n \"sev\": \"medium\",\n \"cat\": \"Collateral Management\",\n \"tags\": [\"collateral\"],\n \"desc\": \"Supported asset whitelist management...\",\n \"prompt\": \"Analyze this Solidity code for collateral validation vulnerabilities...\\n[PASTE YOUR CODE HERE]\\n...\",\n \"fix\": \"Implement conservative collateral factors...\"\n }\n ]\n}\n```\n\n**Important**: Use `scan/.json`, NOT the full `.json`. The full files can be 100KB-1MB and will eat your context. The scan-tier has everything you need for analysis.\n\nIf the file doesn't exist, tell the user the vertical is invalid and list available verticals:\n```bash\nls ${CLAUDE_SKILL_DIR}/frameworks/scan/ | sed 's/.json//'\n```\n\nAlso try to detect the git remote URL for the repoUrl field:\n```bash\ngit remote get-url origin 2>/dev/null || echo \"\"\n```\n\n## Step 3: Filter Checks\n\nApply the same smart filtering as the browser platform (covers documented --config: dexType for dasf, lendingType for lending, etc; uses q.lower() + tags; not exhaustive):\n\n1. If `oracle=none` in config: SKIP checks where q.lower() contains \"oracle\", \"chainlink\", \"price feed\", \"twap\", \"price manipulation\" OR `tags` include \"oracle\"\n2. If `admin=immutable` in config: SKIP checks where q.lower() contains \"governance\", \"voting\", \"delegation\", \"timelock\", \"proposal\" OR `tags` include \"governance\" OR `cat` is \"Role Definition & Management\" or \"Governance & Delegation Attacks\"\n3. If vertical is `lending` and `hasFlashLoans=false`: SKIP checks where q.lower() contains \"flash loan\" OR `tags` include \"flash-loan\"\n If vertical is `lending` and `lendingType=isolated`: SKIP checks where q.lower() contains \"pool-based\" OR `tags` include \"pool-based\"\n If vertical is `dasf` and `dexType=uniswap-v3-cl`: SKIP checks where q.lower() contains \"uniswap-v2\" OR `tags` include \"uniswap-v2\"\n // chains=: metadata only (no per-check skip rules defined)\n // collateralModel=...: metadata only (no per-check skip rules defined)\n // other documented --config (stakingType, vaultType, etc.): metadata only (no per-check skip rules defined)\n\nRecord the total checks after filtering.\n\n## Step 4: Assess Every Check\n\nFor EACH check in the filtered framework:\n\n### 4a. Determine Relevance\nDoes this codebase have code that relates to this check? First Grep using any ci.grepPatterns / functionSignatures / importPatterns present in the loaded scan-tier check object to select candidate files, before falling back to category/q keywords. Identify the relevant files and functions.\n\n- If NO relevant code exists → verdict: `na`\n- If relevant code exists → proceed to analysis\n\n### 4b. Analyze Using Prompt Template\nIf the check has a `prompt` field (not null):\n1. First Grep using any ci.grepPatterns / functionSignatures / importPatterns present in the loaded scan-tier check object to select candidate files, before falling back to category/q keywords. Identify which code sections are relevant to this check\n2. Apply the prompt template's analysis instructions to that code\n3. Determine the verdict\n\nIf `prompt` is null, analyze the check's `q` (question) and `desc` (description) against the code directly.\n\n### 4c. Record Verdict\n\nFor each check, produce:\n```json\n{\n \"status\": \"pass\" | \"fail\" | \"unknown\" | \"na\",\n \"notes\": \"2-4 sentence analysis with specific code references (file:line)\",\n \"evidence\": {\n \"type\": \"krait_analysis\",\n \"tool\": \"Krait by Zealynx\",\n \"promptOrCommand\": \"\",\n \"rawOutput\": \"\",\n \"paths\": [\"src/File.sol\", \"src/Other.sol\"],\n \"commit\": \"\",\n \"createdAt\": \"\"\n },\n \"updatedAt\": \"\"\n}\n```\n\n**Verdict rules:**\n- **pass**: Code correctly handles this security concern. Be specific about WHY it passes.\n- **fail**: Concrete vulnerability or missing protection. Include the exact code location.\n- **na**: Check doesn't apply to this codebase (no relevant code exists).\n- **unknown**: Relevant code exists but you cannot confidently determine pass/fail (note: \"unknown\" status in assess JSON output). This is HONEST — use it when verdict depends on off-chain logic, deployment configuration, or multi-protocol interactions you can't see.\n\n**Do NOT:**\n- Mark a check as `pass` just because you didn't find an issue. If you couldn't thoroughly analyze it, mark `unknown`.\n- Mark a check as `fail` for theoretical concerns. There must be concrete code evidence.\n- Write empty or generic notes. Every verdict needs specific reasoning.\n\n## Step 5: Process in Batches\n\nTo manage context effectively, process checks by CATEGORY:\n\n1. Get the list of unique categories from the filtered checks\n2. For each category:\n a. Announce: \"Analyzing category: ( checks)\"\n b. Read/re-read the relevant source files for this category's domain\n c. Assess each check in the category\n d. Report progress: \"Category complete: X pass, Y fail, Z na, W unknown\"; also echo \"Progress: category done, cumulative so far\" (non-redundant)\n3. After all categories are done, compile the full results\n\nThis approach ensures you stay focused and don't lose context across 40+ checks.\n\n## Step 6: Write Output File\n\nWrite `.zealynx-run.json` to the project root:\n\n```json\n{\n \"projectId\": \"krait-\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"metadata\": {\n \"projectName\": \"\",\n \"chains\": [\"\"],\n \"vertical\": \"\",\n \"adminModel\": \"\",\n \"oracle\": \"\",\n \"repoUrl\": \"\",\n \"dexType\": \"custom\",\n \"lendingType\": \"pool-based\",\n \"collateralModel\": \"unknown\",\n \"hasFlashLoans\": false,\n \"stakingType\": \"custom\",\n \"vaultType\": \"erc4626\",\n \"stablecoinType\": \"cdp\",\n \"bridgeType\": \"lock-mint\"\n },\n \"frameworkId\": \"\",\n \"frameworkVersion\": \"\",\n \"responses\": {\n \"\": {\n \"status\": \"\",\n \"notes\": \"\",\n \"evidence\": { ... } | null,\n \"updatedAt\": \"\"\n }\n },\n \"_krait\": {\n \"version\": \"0.1.0\",\n \"mode\": \"assess\",\n \"vertical\": \"\",\n \"totalChecks\": ,\n \"filteredChecks\": ,\n \"verdicts\": {\n \"pass\": ,\n \"fail\": ,\n \"na\": ,\n \"unknown\": \n },\n \"analyzedFiles\": [\"\"],\n \"commitHash\": \"\",\n \"duration\": \"\"\n }\n}\n```\n\nWrite this using the Write tool to `.zealynx-run.json` in the current working directory.\nReport: \"Writing .zealynx-run.json...\"\nAfter write, validate using node -e (checks responses count == _krait.filteredChecks, all statuses in pass/fail/unknown/na):\n```bash\nnode -e '\nconst fs=require(\"fs\");const r=JSON.parse(fs.readFileSync(\".zealynx-run.json\",\"utf8\"));\nconst fc=r._krait.filteredChecks,rc=Object.keys(r.responses||{}).length;\nconst sts=[\"pass\",\"fail\",\"unknown\",\"na\"];const valid=Object.values(r.responses||{}).every(x=>sts.includes(x.status));\nconsole.log(\"Validation:\",(rc===fc&&valid)?\"OK\":\"FAIL rc=\"+rc+\" fc=\"+fc+\" validSt=\"+valid);\n'\n```\n\n## Step 7: Terminal Report\n\nAfter writing the file, output a summary to terminal:\n\n```\n🐍 Krait Assessment Complete\n━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nProject: \nVertical: (