Complete AI Training
Sign inGet my AI kit

Your job's AI kit

Get your AI kit

Tell us who you are and what you do. We show you your kit right away and email you the link: skills, prompts, AI agents, MCP servers and courses for your job.

500+ jobs ready, and we make a kit for any other job. No payment needed to look.

Share

AI agent for blockchain developers

Contract Static Analysis Triage Agent

Find the real vulnerabilities among analyzer output and confirm each with a test

Risk managementQuality controlIT and development
See how it worksGet access
Contract Static Analysis Triage Agent: what goes in, what the agent does and what you get

What it does

Running a contract analyzer and a fuzzer gives hundreds of warnings, and a real reentrancy bug hides among the noise. This agent runs the analyzers and fuzzers on each contract, then reads every result in the code context. For each warning, it tries to reproduce it in a test: can an attacker really reach this state and take funds? It ranks confirmed issues by funds at risk and ease of attack, and marks unconfirmed ones with the reason. After the developer fixes a confirmed issue, it reruns the analyzers and the reproducing test to confirm that it now fails to exploit. The developer approves each fix. Edge case: a warning is real in theory but guarded by an access control, so the agent labels it informational.

How it works

Follow the arrows from top to bottom. The orange dashed arrow is the loop: when a check fails, the agent goes back and tries again.

Start and resultWhat it doesA check on its own workWaits for your OKGoes back and retries
Yes, continueApprovedYes, continueNoNo 1 STARTS WHEN Contract change or pre-audit review 2 USES A TOOL Run the analyzers and fuzzers 3 USES A TOOL Read each warning in the code context 4 DOES Write a test that tries to reproduce the issue 5 USES A TOOL Run the reproduction test 6 CHECKS THE RESULT Does the test show the exploit? If not: try a different attack path; if none works, markit as unconfirmed with the reason. Back to step 3. 7 DOES Rank confirmed issues by funds at risk and attackeffort 8 YOU APPROVE Developer approves the fixes to apply 9 USES A TOOL Apply fixes and rerun analyzers and reproductiontests 10 CHECKS THE RESULT Do the exploit tests fail and no new warningsappear? If not: return the issue with the new result and proposeanother fix. Back to step 8. 11 RESULT Triage report with confirmed, unconfirmed andinformational findings
Read the steps as a list
  1. Contract change or pre-audit review
  2. Run the analyzers and fuzzers
  3. Read each warning in the code context
  4. Write a test that tries to reproduce the issue
  5. Run the reproduction test
  6. Does the test show the exploit?If not: try a different attack path; if none works, mark it as unconfirmed with the reason. Back to step 3.
  7. Rank confirmed issues by funds at risk and attack effort
  8. Developer approves the fixes to applyThe agent waits here for your OK.
  9. Apply fixes and rerun analyzers and reproduction tests
  10. Do the exploit tests fail and no new warnings appear?If not: return the issue with the new result and propose another fix. Back to step 8.
  11. Triage report with confirmed, unconfirmed and informational findings

How it decides

It calls a finding confirmed only when a reproducing test shows the exploit, and ranks it by funds at risk and attacker effort.

  • Rank issues that move funds above all others
  • Confirm only with a reproducing test
  • Mark guarded warnings as informational with the guard named
  • Rerun the full test suite after every fix

Make it yours

Every agent is a starting point. You choose these settings for your own situation.

  • Analyzers and fuzz settings
  • Severity ranking rules
  • Fork block and network
  • Test framework
  • Informational vs accepted-risk wording

What keeps you in control

It always asks you first

  • Developer approves fixes
  • Security lead approves marking a confirmed issue as accepted risk

Hard limits

  • Run tests only on a local chain or fork, never on live contracts
  • Never deploy or send transactions to a live network

It stops when

  • Done: all confirmed issues are fixed and retested
  • Stop: the contract design needs to change to fix an issue

Set it up

We guide you through the set-up, step by step

Members get the full set-up guide for this agent. No technical skills needed: you copy, paste and upload.

10 minto set it up in your AI
5 AIsChatGPT, Claude, Copilot, Gemini, Grok
  • One set of instructions to paste into your AI, with the clicks for ChatGPT, Claude, Microsoft 365 Copilot, Gemini and Grok
  • The agent then walks you through connecting your own data, one source at a time
  • A downloadable copy with the flow chart, the rules and the full guide
Get access to this agent

An example run

What happensThe analyzers produced 212 warnings for a vault contract. After reading, 9 looked real. The agent wrote exploit tests and confirmed 2: a reentrancy in withdraw and an unchecked return value. The reentrancy test drained 40 ETH in a local fork. After the developer's fix, the reentrancy test failed to exploit, but the second check found a new warning in the same function, so it looped back with a revised suggestion.

More agents for blockchain developers

Quality control · Product development

Product Documentation Task Test Agent

Docs examples that work exactly as written.

8 steps2 checks3 jobs
Decisions · IT and development

Blockchain Use Case Feasibility Screen Agent

A fair, documented screen of a blockchain proposal with a clear recommendation

10 steps2 checks6 jobs
Coding · Quality control

Test Coverage Gap Closing Agent

Add tests to the riskiest untested code and prove that they catch real bugs

10 steps2 checks11 jobs
Quality control · Compliance

Audit Finding Fix Verification Agent

Prove each audit fix works and breaks nothing else, with evidence for the auditors

11 steps2 checks4 jobs