Three skills divide preparation, auditing, and fuzzing
pashov/skills contains 3 main workflows for Solidity security work. x-ray maps a protocol before deeper review. Solidity Auditor sends agents through contract code and combines their findings. Fizz builds a fuzzing suite for Foundry or Hardhat projects. That separation is sensible: inventory, bug hunting, and property testing are different jobs, and each produces artifacts a developer can inspect rather than one long chat response.
x-ray writes a protocol overview, entry-point map, invariant map, and architecture diagram. Its 10-file directory includes shell and Python scripts for source enumeration, Git history, and SVG generation. The result is meant to expose trust boundaries and missing test categories before an audit begins. This is useful preparation, provided the source measurements are correct and the reported invariants are checked against the contracts.
Fizz writes Solidity that your team must own
Fizz is the largest of the 3 packages, with 65 files in its directory at the fetched revision. It can create a harness, handlers, invariants, a plain-English property list, deterministic reproduction tests, and a campaign report. The supporting scripts invoke Echidna or Medusa and help select functions, extract ABIs, estimate cost, and keep the generated suite synchronized after contract changes.
Generated fuzz code is only useful when its properties describe the protocol. A harness may compile while omitting a privileged path, using an unrealistic actor, or asserting a weak invariant. The Fizz documentation asks users to review entry points and properties in guided mode on the first run. That review is the job. The agent saves setup time, while the protocol team remains responsible for knowing what must never happen.
What happened when we ran it
Our lab did not execute pashov/skills. The repository's detected language was JavaScript, but the review runner had no supported ecosystem for this project and found no Dockerfile to supply one. We therefore have no measured package count, disk use, install time, build result, test count, or dependency-audit result. Any claim that the three skills ran successfully in our sandbox would be false.
This matters because the repository is a collection of instructions and helper scripts rather than one application with a single start command. A meaningful test would need a suitable Solidity target, one of the 5 named coding-agent platforms, and the local contract toolchain required by the chosen workflow. We inspected the documented process and repository contents, but that is not evidence that an end-to-end audit or fuzz campaign completes on a reader's machine.
macOS can turn x-ray measurements into zeros
Open pull request 47 documents a sharp portability failure in x-ray's first step. Its shell script uses GNU grep's -P option in 15 places, while the BSD grep shipped with macOS does not support that option. According to the report, the script can still exit successfully and reduce failed measurements to zero. A protocol with tests may then be described as having none. The proposed fix replaces those expressions with portable extended regular expressions.
The pull request remained open when we fetched the repository, so its diagnosis and patch were not part of the reviewed main branch. This is more serious than a noisy error because a believable zero can steer the later agent analysis. macOS users should apply or verify the fix, then compare file and test counts against an independent command before using x-ray's gap analysis. Linux users should still read stderr and spot-check the generated inventory.
Solidity Auditor is a lead generator, not an approval stamp
Solidity Auditor can scan named files or run several passes in loop mode. The README suggests targeting 2 to 5 hot contracts so each agent gets denser context, and says 3 passes are a reasonable default. Later passes receive earlier findings and seek different ground, after which one report collects the results. This can surface leads quickly, yet repeated model output is not independent proof that a contract is safe.
A competent reviewer still has to reproduce each finding, trace reachable state, verify privilege assumptions, and reject duplicates or impossible paths. The project says this directly by positioning the skill as a check before formal review. That limit is especially important for deployed-value decisions, where a confident false negative costs far more than the minutes an agent may save. Use the report to choose where humans look next.
September activity is current, while release notes are thin
GitHub showed 1,202 stars, 5 combined open issues and pull requests, and a last push on September 23, 2026. Release v23092026 was published the same day, though its release page contained no notes. Current pull requests discuss x-ray portability, Fizz generator behavior, coverage shutdown timing, and optional symbolic verification. That is active technical work, but the open queue also contains changes that affect correctness.
The best use of pashov/skills is bounded: let x-ray organize the first reading, let Solidity Auditor produce candidates, and let Fizz draft properties and harness code. Then verify every artifact with the contract's own tests and a human security review. The 3-part structure is practical, and the MIT license makes adaptation easy. The missing lab run and open false-zero report keep it out of the unattended-security category.