shawnchee/The Auditor PR Reviewer

Automatically audits Solidity, Move, and Rust smart contracts on every PR using Slither, Aderyn, Cargo-Audit, and Gemini

Trust Signals

name	description	required	default
gemini_api_key	Google Gemini API key for AI-powered analysis.	yes	—
gemini_model	Gemini model to use for analysis.	no	gemini-2.5-flash
github_token	GitHub token for posting PR review comments. Defaults to the automatic GITHUB_TOKEN.	no	${{ github.token }}
slither_args	Additional arguments to pass to Slither (e.g., '--exclude naming-convention').	no	""
aderyn_args	Additional arguments to pass to Aderyn.	no	""
cargo_audit_args	Additional arguments to pass to cargo-audit.	no	""
severity_threshold	Minimum severity to report: 'low', 'medium', 'high', or 'critical'.	no	low
fail_on_findings	If 'true', the action will exit with a non-zero code when there are HIGH or CRITICAL vulnerabilities.	no	true
custom_prompt	Optional additional instructions for the Gemini AI reviewer (e.g., 'Focus on reentrancy and access control').	no	""
include_paths	Comma-separated glob patterns of paths to include (e.g., 'contracts/,src/'). Defaults to all supported files.	no	""
exclude_paths	Comma-separated glob patterns of paths to exclude (e.g., 'test/,mocks/').	no	""
include_raw_output	If 'true', posts a second PR comment with the raw unprocessed output from Slither, Aderyn, and cargo-audit.	no	false

name	description
vulnerability_count	Total number of vulnerabilities found across all tools and chains.
critical_count	Number of critical-severity findings.
high_count	Number of high-severity findings.
medium_count	Number of medium-severity findings.
low_count	Number of low/informational findings.
security_score	Overall security score from 0-100 calculated by PR Auditor.
report_url	URL of the posted PR review comment (if applicable).