Crypto Security skills for AI agents

Triggers when a user asks about blockchain forensics, transaction tracing, fund flow analysis, Chainalysis, mixer detection, or crypto investigation. Covers address clustering, fund flow analysis, Tornado Cash and mixer detection, cross-chain tracing, CEX attribution, OFAC compliance, sanctions screening, and evidence preservation for legal proceedings.

Triggers when a user asks about preventing DeFi exploits, implementing reentrancy protection, oracle security, access control patterns, or security patterns for smart contracts. Covers checks-effects-interactions, ReentrancyGuard, TWAP oracles, flash loan resistance, slippage protection, timelocks, upgrade safety, and emergency pause mechanisms.

Triggers when a user asks about a DeFi exploit, hack, post-mortem, or attack vector. Provides methodology for analyzing historical exploits using databases like Rekt.news, reproducing attacks in Foundry, and extracting defensive lessons. Covers oracle manipulation, flash loan attacks, governance attacks, and bridge exploits.

Triggers when a user asks about preventing flash loan exploits, securing DeFi protocols against price manipulation, or implementing robust liquidity and oracle checks. This skill teaches you how to design and build smart contracts that are resilient to the unique attack vectors enabled by uncollateralized, same-block loans.

Triggers when a user asks about formal verification, Certora, Halmos, symbolic execution, writing invariants, or specifications for smart contracts. Covers Certora Prover with CVL, Halmos for symbolic testing, KEVM, property-based testing, model checking, and verification of token standards, AMM invariants, and lending protocol safety properties.

Triggers when a user asks about gas optimization, gas-efficient code, storage optimization, or assembly-level optimization in smart contracts. Covers storage packing, transient storage (EIP-1153), calldata optimization, inline assembly for hot paths, when optimization introduces bugs, common gas-optimization antipatterns that create vulnerabilities, benchmarking, and gas profiling tools like forge gas reports and Tenderly.

Triggers when a user asks about crypto incident response, hack response, emergency procedures, war room operations, or bug bounty programs. Covers detection and monitoring, containment via contract pausing and address blacklisting, investigation with transaction tracing tools, communication protocols, working with law enforcement, recovery strategies, and Immunefi bug bounties.

Triggers when a user asks about secure Move language development, auditing Move contracts, resource ownership, capability-based access control, object lifecycle management, or general exploit mitigation in the Move ecosystem (Sui, Aptos, Starcoin). This skill teaches you how to leverage Move's unique type system and resource model to build robust, secure smart contracts.

Triggers when a user asks about operational security for crypto trading firms, key management policies, transaction signing procedures, deployment security, or institutional key management. Covers CI/CD for smart contracts, private key rotation, access control matrices, employee onboarding/offboarding, HSMs, air-gapped signing, and MPC for institutional operations.

Triggers when you need to secure a DeFi protocol against price oracle manipulation, stale price exploits, or external data feed attacks. This skill teaches you to integrate oracles robustly, implement defensive checks, and design resilient smart contracts that can withstand malicious price feeds.

Triggers when you need to prevent reentrancy attacks in smart contracts, especially in DeFi protocols, DAOs, or any system handling token transfers or critical state changes. This skill teaches you to implement robust patterns and utilize safeguards to protect your contract's integrity and user funds.

Triggers when a user requests an audit, security review, or vulnerability assessment of a smart contract. Employs manual review methodology (line-by-line, state machine analysis, access control review) alongside automated tools such as Slither, Mythril, Echidna, and Medusa. Covers common vulnerability patterns including reentrancy, integer overflow, access control flaws, front-running, price manipulation, and flash loan attacks.

Triggers when a user asks about secure Solana program development, auditing Solana contracts, account validation, CPI security, PDA management, reentrancy prevention on Solana, or general exploit mitigation in the Solana ecosystem. This skill teaches you how to design, implement, and test Solana programs that are resilient against common vulnerabilities.

Triggers when you need to implement delayed execution for critical operations, enhance governance security, or manage staged releases of funds or features in a decentralized application. This skill teaches you how to design and integrate cryptographic time-locks to prevent immediate, unilateral changes and provide a window for review and intervention.

Triggers when a user asks about smart contract upgrade patterns, proxy contracts, UUPS, transparent proxies, diamond pattern, storage layout management, or migration strategies. Covers all major proxy types, ERC-7201 namespaced storage, initialization vulnerabilities, upgrade governance with timelocks, migration strategies, immutable vs upgradeable tradeoffs, and upgrade simulation and testing.

Triggers when a user asks about wallet security, key management, multisig setup, seed phrase protection, cold storage, or operational security for crypto holdings. Covers hot vs cold wallets, hardware wallets (Ledger, Trezor), multisig (Safe/Gnosis), MPC wallets, BIP-32/39/44 derivation paths, social engineering defenses, phishing detection, and approval management via revoke.cash.