How does the Estimator calculate audit hours?

It utilizes NLoC (Net Lines of Code) and cognitive complexity metrics, then applies domain-specific multipliers based on the presence of complex logic such as cryptography, ZK circuits, or low-level assembly.

What code categories does the skill recognize?

It categorizes files into business-logic, infra/glue, presentation, tests, generated, and scripts, automatically prioritizing business-logic for security review.

Does it support incremental reviews for specific changes?

Yes, the skill includes a dedicated diff-scope mode that allows you to compare branches or commits, triaging only the modified files to estimate the delta effort required.

Can I adjust the generated estimates?

Absolutely. The skill follows a strict checkpoint-based workflow, including a reflection phase where you can review findings and manually adjust hours before the final report is generated.

Audit Scoping & Estimation

Name: Audit Scoping & Estimation
Author: Artifex1

byArtifex1

•

安全与测试

Conducts project scoping and security audit effort estimation using logical chunking and automated metric analysis.

The Estimator skill streamlines the planning phase of security engagements by automatically scoping codebases and calculating precise audit hours. It intelligently organizes files into logical chunks, distinguishes core business logic from boilerplate infrastructure, and applies domain-specific multipliers for complex patterns like ZK circuits or low-level assembly. Whether you are assessing a full repository or a specific diff, it provides detailed NLoC, cognitive complexity metrics, and adjustable time estimates to ensure accurate project resource allocation.

主要功能

01NLoC and cognitive complexity metric calculation

02Automated codebase scoping and logical file chunking

03Diff-based estimation for incremental security reviews

043 GitHub stars

05Context-aware call chain analysis for impact assessment

06Domain-specific effort multipliers for advanced technologies

使用场景

01Calculating the duration and cost for a smart contract security audit

02Triaging code changes in a Pull Request to determine review priority

03Analyzing repository complexity to guide engineering resource allocation

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add artifex1/auditor-addon estimator

For use in Claude.ai and ChatGPT