@dilukangelo/web3-ai-skills 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +112 -0
- package/bin/cli.js +74 -0
- package/package.json +50 -0
- package/template/.agent/ARCHITECTURE.md +129 -0
- package/template/.agent/GEMINI.md +135 -0
- package/template/.agent/agents/contract-auditor.md +161 -0
- package/template/.agent/agents/rust-web3.md +153 -0
- package/template/.agent/agents/solidity-expert.md +164 -0
- package/template/.agent/agents/web3-frontend.md +192 -0
- package/template/.agent/agents/web3-infra.md +155 -0
- package/template/.agent/agents/web3-orchestrator.md +145 -0
- package/template/.agent/skills/clean-code/SKILL.md +142 -0
- package/template/.agent/skills/dapp-patterns/SKILL.md +184 -0
- package/template/.agent/skills/rainbowkit-wagmi/SKILL.md +262 -0
- package/template/.agent/skills/rpc-optimization/SKILL.md +194 -0
- package/template/.agent/skills/rust-smart-contracts/SKILL.md +202 -0
- package/template/.agent/skills/smart-contract-auditing/SKILL.md +198 -0
- package/template/.agent/skills/solidity-patterns/SKILL.md +192 -0
- package/template/.agent/skills/subgraph-indexing/SKILL.md +225 -0
- package/template/.agent/workflows/audit.md +126 -0
- package/template/.agent/workflows/create-contract.md +134 -0
- package/template/.agent/workflows/create-dapp.md +109 -0
- package/template/.agent/workflows/deploy-contract.md +120 -0
package/README.md
ADDED
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
# Web3 AI Skills
|
|
2
|
+
|
|
3
|
+
> 🚀 AI Agent templates for Web3 development — Solidity, Rust, DApp frontends, auditing, RPC, and indexing.
|
|
4
|
+
|
|
5
|
+
Supercharge your AI coding assistant with specialized Web3 knowledge. This package provides ready-to-use agent configurations, skills, and workflows for building on EVM chains, Solana, and beyond.
|
|
6
|
+
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
## Quick Start
|
|
10
|
+
|
|
11
|
+
### Option 1: npx (no install)
|
|
12
|
+
```bash
|
|
13
|
+
npx @dilukangelo/web3-ai-skills init
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
### Option 2: Global install
|
|
17
|
+
```bash
|
|
18
|
+
npm install -g @dilukangelo/web3-ai-skills
|
|
19
|
+
web3-ai-skills init
|
|
20
|
+
# or shorthand:
|
|
21
|
+
w3ai init
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
This creates a `.agent/` folder in your current directory with all Web3 agents, skills, and workflows.
|
|
25
|
+
|
|
26
|
+
---
|
|
27
|
+
|
|
28
|
+
## What's Included
|
|
29
|
+
|
|
30
|
+
### 🤖 6 Specialist Agents
|
|
31
|
+
|
|
32
|
+
| Agent | Focus |
|
|
33
|
+
|-------|-------|
|
|
34
|
+
| **solidity-expert** | EVM smart contracts, Foundry, Hardhat, gas optimization |
|
|
35
|
+
| **rust-web3** | Solana (Anchor), CosmWasm, Arbitrum Stylus |
|
|
36
|
+
| **web3-frontend** | Next.js 15+, RainbowKit v2, Wagmi v2, viem |
|
|
37
|
+
| **contract-auditor** | Slither, Mythril, Aderyn, manual review |
|
|
38
|
+
| **web3-infra** | RPC optimization, Multicall3, MEV protection |
|
|
39
|
+
| **web3-orchestrator** | Multi-agent coordination for full-stack DApps |
|
|
40
|
+
|
|
41
|
+
### 🧩 8 Skills
|
|
42
|
+
|
|
43
|
+
| Skill | Description |
|
|
44
|
+
|-------|-------------|
|
|
45
|
+
| **solidity-patterns** | Solidity 0.8.x+, ERC standards, gas optimization |
|
|
46
|
+
| **rust-smart-contracts** | Anchor/Solana, CosmWasm, Stylus |
|
|
47
|
+
| **rainbowkit-wagmi** | Wallet integration, SIWE, multi-chain |
|
|
48
|
+
| **smart-contract-auditing** | Audit methodology, vulnerability taxonomy |
|
|
49
|
+
| **dapp-patterns** | IPFS, ENS, token gating, account abstraction |
|
|
50
|
+
| **rpc-optimization** | Multicall3, batching, caching, MEV protection |
|
|
51
|
+
| **subgraph-indexing** | The Graph, Ponder, Subsquid, Envio |
|
|
52
|
+
| **clean-code** | Web3-specific coding standards |
|
|
53
|
+
|
|
54
|
+
### 🔄 4 Workflows
|
|
55
|
+
|
|
56
|
+
| Command | Description |
|
|
57
|
+
|---------|-------------|
|
|
58
|
+
| `/deploy-contract` | Deploy & verify smart contracts |
|
|
59
|
+
| `/audit` | Run security audit |
|
|
60
|
+
| `/create-dapp` | Scaffold new DApp |
|
|
61
|
+
| `/create-contract` | Scaffold new contract project |
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
## Usage
|
|
66
|
+
|
|
67
|
+
After running `init`, your project will have a `.agent/` folder:
|
|
68
|
+
|
|
69
|
+
```
|
|
70
|
+
.agent/
|
|
71
|
+
├── GEMINI.md # Core AI instructions
|
|
72
|
+
├── ARCHITECTURE.md # System overview
|
|
73
|
+
├── agents/ # 6 specialist agents
|
|
74
|
+
├── skills/ # 8 domain skills
|
|
75
|
+
├── workflows/ # 4 slash commands
|
|
76
|
+
└── scripts/ # Validation scripts
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
Your AI assistant will automatically pick the right agent based on your request:
|
|
80
|
+
- Writing Solidity? → `solidity-expert` agent activates
|
|
81
|
+
- Building a DApp frontend? → `web3-frontend` agent activates
|
|
82
|
+
- Auditing a contract? → `contract-auditor` agent activates
|
|
83
|
+
|
|
84
|
+
---
|
|
85
|
+
|
|
86
|
+
## CLI Options
|
|
87
|
+
|
|
88
|
+
```bash
|
|
89
|
+
# Init with default directory (.agent)
|
|
90
|
+
web3-ai-skills init
|
|
91
|
+
|
|
92
|
+
# Init to custom directory
|
|
93
|
+
web3-ai-skills init --dir .my-agents
|
|
94
|
+
|
|
95
|
+
# Force overwrite existing files
|
|
96
|
+
web3-ai-skills init --force
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
---
|
|
100
|
+
|
|
101
|
+
## Supported Chains & Ecosystems
|
|
102
|
+
|
|
103
|
+
**EVM**: Ethereum, Polygon, Arbitrum, Base, Optimism, Monad, ApeChain
|
|
104
|
+
**Non-EVM**: Solana (Anchor), CosmWasm, Arbitrum Stylus
|
|
105
|
+
**Indexers**: The Graph, Ponder, Subsquid, Envio, Goldsky
|
|
106
|
+
**Wallets**: RainbowKit, ConnectKit, Privy, Dynamic, Web3Modal
|
|
107
|
+
|
|
108
|
+
---
|
|
109
|
+
|
|
110
|
+
## License
|
|
111
|
+
|
|
112
|
+
MIT
|
package/bin/cli.js
ADDED
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
|
|
3
|
+
import { Command } from "commander";
|
|
4
|
+
import fs from "fs-extra";
|
|
5
|
+
import path from "path";
|
|
6
|
+
import { fileURLToPath } from "url";
|
|
7
|
+
import chalk from "chalk";
|
|
8
|
+
import ora from "ora";
|
|
9
|
+
|
|
10
|
+
// Handle __dirname in ES modules
|
|
11
|
+
const __filename = fileURLToPath(import.meta.url);
|
|
12
|
+
const __dirname = path.dirname(__filename);
|
|
13
|
+
|
|
14
|
+
const program = new Command();
|
|
15
|
+
|
|
16
|
+
program
|
|
17
|
+
.name("web3-ai-skills")
|
|
18
|
+
.description("CLI to initialize the Web3 AI Agent Skills template")
|
|
19
|
+
.version("1.0.0");
|
|
20
|
+
|
|
21
|
+
program
|
|
22
|
+
.command("init")
|
|
23
|
+
.description("Initialize Web3 AI skills in the current directory")
|
|
24
|
+
.option("-d, --dir <directory>", "Target directory to install", ".agent")
|
|
25
|
+
.option("-f, --force", "Force overwrite existing files", false)
|
|
26
|
+
.action(async (options) => {
|
|
27
|
+
const targetDir = path.resolve(process.cwd(), options.dir);
|
|
28
|
+
const sourceDir = path.resolve(__dirname, "../template/.agent");
|
|
29
|
+
|
|
30
|
+
console.log(
|
|
31
|
+
chalk.blueBright(`\n🚀 Initializing Web3 AI Skills in ${chalk.bold(targetDir)}...\n`)
|
|
32
|
+
);
|
|
33
|
+
|
|
34
|
+
const spinner = ora("Copying Web3 Agent templates...").start();
|
|
35
|
+
|
|
36
|
+
try {
|
|
37
|
+
// Check if target exists
|
|
38
|
+
if (fs.existsSync(targetDir) && !options.force) {
|
|
39
|
+
spinner.fail(
|
|
40
|
+
chalk.red(
|
|
41
|
+
`Directory ${chalk.bold(
|
|
42
|
+
options.dir
|
|
43
|
+
)} already exists! Use --force to overwrite.`
|
|
44
|
+
)
|
|
45
|
+
);
|
|
46
|
+
process.exit(1);
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
// Check if source exists
|
|
50
|
+
if (!fs.existsSync(sourceDir)) {
|
|
51
|
+
spinner.fail(chalk.red("Template source not found! Is the package corrupted?"));
|
|
52
|
+
process.exit(1);
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
// Copy files
|
|
56
|
+
await fs.copy(sourceDir, targetDir, {
|
|
57
|
+
overwrite: options.force,
|
|
58
|
+
errorOnExist: false,
|
|
59
|
+
});
|
|
60
|
+
|
|
61
|
+
spinner.succeed(chalk.green("Web3 AI Skills initialized successfully! 🎉"));
|
|
62
|
+
|
|
63
|
+
console.log(`\n${chalk.cyan("Next steps:")}`);
|
|
64
|
+
console.log(`1. Review the generated ${chalk.bold(options.dir)} folder.`);
|
|
65
|
+
console.log(`2. Read ${chalk.bold(path.join(options.dir, "GEMINI.md"))} to understand the Web3 agent protocol.`);
|
|
66
|
+
console.log(`3. Start interacting with your specialized Web3 Agents!\n`);
|
|
67
|
+
} catch (error) {
|
|
68
|
+
spinner.fail(chalk.red("Oops! Something went wrong during initialization."));
|
|
69
|
+
console.error(error);
|
|
70
|
+
process.exit(1);
|
|
71
|
+
}
|
|
72
|
+
});
|
|
73
|
+
|
|
74
|
+
program.parse();
|
package/package.json
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@dilukangelo/web3-ai-skills",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"description": "CLI to initialize Web3 AI Agent Skills — Solidity, Rust, DApp frontends, auditing, RPC, and indexing for 2026",
|
|
5
|
+
"main": "bin/cli.js",
|
|
6
|
+
"type": "module",
|
|
7
|
+
"bin": {
|
|
8
|
+
"web3-ai-skills": "./bin/cli.js",
|
|
9
|
+
"w3ai": "./bin/cli.js"
|
|
10
|
+
},
|
|
11
|
+
"files": [
|
|
12
|
+
"bin/",
|
|
13
|
+
"template/",
|
|
14
|
+
"README.md",
|
|
15
|
+
"LICENSE"
|
|
16
|
+
],
|
|
17
|
+
"scripts": {
|
|
18
|
+
"test": "node bin/cli.js --help"
|
|
19
|
+
},
|
|
20
|
+
"repository": {
|
|
21
|
+
"type": "git",
|
|
22
|
+
"url": "git+https://github.com/dilukangelosl/web3-ai-skills.git"
|
|
23
|
+
},
|
|
24
|
+
"keywords": [
|
|
25
|
+
"web3",
|
|
26
|
+
"ai",
|
|
27
|
+
"agent",
|
|
28
|
+
"skills",
|
|
29
|
+
"solidity",
|
|
30
|
+
"rust",
|
|
31
|
+
"rainbowkit",
|
|
32
|
+
"wagmi",
|
|
33
|
+
"smart-contract",
|
|
34
|
+
"audit",
|
|
35
|
+
"gemini",
|
|
36
|
+
"antigravity"
|
|
37
|
+
],
|
|
38
|
+
"author": "dilukangelo",
|
|
39
|
+
"license": "MIT",
|
|
40
|
+
"bugs": {
|
|
41
|
+
"url": "https://github.com/dilukangelosl/web3-ai-skills/issues"
|
|
42
|
+
},
|
|
43
|
+
"homepage": "https://github.com/dilukangelosl/web3-ai-skills#readme",
|
|
44
|
+
"dependencies": {
|
|
45
|
+
"chalk": "^5.3.0",
|
|
46
|
+
"commander": "^14.0.3",
|
|
47
|
+
"fs-extra": "^11.3.3",
|
|
48
|
+
"ora": "^8.0.1"
|
|
49
|
+
}
|
|
50
|
+
}
|
|
@@ -0,0 +1,129 @@
|
|
|
1
|
+
# Web3 AI Skills Architecture
|
|
2
|
+
|
|
3
|
+
> Comprehensive Web3 Agent Capability Expansion Toolkit — 2026 Edition
|
|
4
|
+
|
|
5
|
+
---
|
|
6
|
+
|
|
7
|
+
## 📋 Overview
|
|
8
|
+
|
|
9
|
+
Web3 AI Skills is a modular system consisting of:
|
|
10
|
+
|
|
11
|
+
- **6 Specialist Agents** — Web3-specific role-based AI personas
|
|
12
|
+
- **8 Skills** — Deep domain knowledge modules for blockchain development
|
|
13
|
+
- **4 Workflows** — Slash command procedures for common Web3 tasks
|
|
14
|
+
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
## 🏗️ Directory Structure
|
|
18
|
+
|
|
19
|
+
```plaintext
|
|
20
|
+
.agent/
|
|
21
|
+
├── GEMINI.md # Core instructions
|
|
22
|
+
├── ARCHITECTURE.md # This file
|
|
23
|
+
├── agents/ # 6 Specialist Agents
|
|
24
|
+
├── skills/ # 8 Skills
|
|
25
|
+
├── workflows/ # 4 Slash Commands
|
|
26
|
+
└── scripts/ # Validation Scripts
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
## 🤖 Agents (6)
|
|
32
|
+
|
|
33
|
+
| Agent | Focus | Skills Used |
|
|
34
|
+
| ---------------------- | --------------------------------- | ------------------------------------------------ |
|
|
35
|
+
| `solidity-expert` | EVM smart contracts, Foundry | solidity-patterns, smart-contract-auditing |
|
|
36
|
+
| `rust-web3` | Solana/Anchor, CosmWasm, Rust | rust-smart-contracts |
|
|
37
|
+
| `web3-frontend` | Next.js + RainbowKit + Wagmi | rainbowkit-wagmi, dapp-patterns |
|
|
38
|
+
| `contract-auditor` | Security audits, Slither, Mythril | smart-contract-auditing |
|
|
39
|
+
| `web3-infra` | RPC, indexers, nodes, subgraphs | rpc-optimization, subgraph-indexing |
|
|
40
|
+
| `web3-orchestrator` | Multi-agent Web3 coordination | All skills |
|
|
41
|
+
|
|
42
|
+
---
|
|
43
|
+
|
|
44
|
+
## 🧩 Skills (8)
|
|
45
|
+
|
|
46
|
+
### Smart Contracts
|
|
47
|
+
|
|
48
|
+
| Skill | Description |
|
|
49
|
+
| --------------------------- | -------------------------------------------------- |
|
|
50
|
+
| `solidity-patterns` | Solidity 0.8.x+, ERC standards, gas optimization |
|
|
51
|
+
| `rust-smart-contracts` | Anchor/Solana programs, CosmWasm, Stylus |
|
|
52
|
+
| `smart-contract-auditing` | Audit methodology, Slither, Mythril, Aderyn |
|
|
53
|
+
|
|
54
|
+
### DApp Frontend
|
|
55
|
+
|
|
56
|
+
| Skill | Description |
|
|
57
|
+
| --------------------------- | -------------------------------------------------- |
|
|
58
|
+
| `rainbowkit-wagmi` | RainbowKit v2, Wagmi v2, viem, wallet integration |
|
|
59
|
+
| `dapp-patterns` | DApp architecture, IPFS, ENS, signing patterns |
|
|
60
|
+
|
|
61
|
+
### Infrastructure
|
|
62
|
+
|
|
63
|
+
| Skill | Description |
|
|
64
|
+
| --------------------------- | -------------------------------------------------- |
|
|
65
|
+
| `rpc-optimization` | RPC management, Multicall3, batching, MEV |
|
|
66
|
+
| `subgraph-indexing` | The Graph, Ponder, custom indexers, event parsing |
|
|
67
|
+
|
|
68
|
+
### General
|
|
69
|
+
|
|
70
|
+
| Skill | Description |
|
|
71
|
+
| --------------------------- | -------------------------------------------------- |
|
|
72
|
+
| `clean-code` | Coding standards (Global) applied to Web3 |
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
## 🔄 Workflows (4)
|
|
77
|
+
|
|
78
|
+
| Command | Description |
|
|
79
|
+
| ------------------ | -------------------------------------------- |
|
|
80
|
+
| `/deploy-contract` | Deploy & verify smart contracts |
|
|
81
|
+
| `/audit` | Run security audit on smart contracts |
|
|
82
|
+
| `/create-dapp` | Scaffold a new DApp with wallet integration |
|
|
83
|
+
| `/create-contract` | Scaffold a new smart contract project |
|
|
84
|
+
|
|
85
|
+
---
|
|
86
|
+
|
|
87
|
+
## 🎯 Skill Loading Protocol
|
|
88
|
+
|
|
89
|
+
```plaintext
|
|
90
|
+
User Request → Skill Description Match → Load SKILL.md
|
|
91
|
+
↓
|
|
92
|
+
Read references/
|
|
93
|
+
↓
|
|
94
|
+
Read scripts/
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
### Skill Structure
|
|
98
|
+
|
|
99
|
+
```plaintext
|
|
100
|
+
skill-name/
|
|
101
|
+
├── SKILL.md # (Required) Metadata & instructions
|
|
102
|
+
├── scripts/ # (Optional) Python/Bash scripts
|
|
103
|
+
├── references/ # (Optional) Templates, docs
|
|
104
|
+
└── assets/ # (Optional) Images, logos
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
---
|
|
108
|
+
|
|
109
|
+
## 📊 Statistics
|
|
110
|
+
|
|
111
|
+
| Metric | Value |
|
|
112
|
+
| ------------------- | ------------ |
|
|
113
|
+
| **Total Agents** | 6 |
|
|
114
|
+
| **Total Skills** | 8 |
|
|
115
|
+
| **Total Workflows** | 4 |
|
|
116
|
+
| **Coverage** | Web3 / EVM / Solana / DApp |
|
|
117
|
+
|
|
118
|
+
---
|
|
119
|
+
|
|
120
|
+
## 🔗 Quick Reference
|
|
121
|
+
|
|
122
|
+
| Need | Agent | Skills |
|
|
123
|
+
| ------------------- | -------------------- | -------------------------------------------- |
|
|
124
|
+
| Solidity Contract | `solidity-expert` | solidity-patterns, smart-contract-auditing |
|
|
125
|
+
| Rust Contract | `rust-web3` | rust-smart-contracts |
|
|
126
|
+
| DApp Frontend | `web3-frontend` | rainbowkit-wagmi, dapp-patterns |
|
|
127
|
+
| Contract Audit | `contract-auditor` | smart-contract-auditing |
|
|
128
|
+
| RPC / Infra | `web3-infra` | rpc-optimization, subgraph-indexing |
|
|
129
|
+
| Full-Stack DApp | `web3-orchestrator` | All skills |
|
|
@@ -0,0 +1,135 @@
|
|
|
1
|
+
---
|
|
2
|
+
trigger: always_on
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# GEMINI.md - Web3 AI Skills
|
|
6
|
+
|
|
7
|
+
> This file defines how the AI behaves in this Web3-focused workspace.
|
|
8
|
+
|
|
9
|
+
---
|
|
10
|
+
|
|
11
|
+
## CRITICAL: AGENT & SKILL PROTOCOL (START HERE)
|
|
12
|
+
|
|
13
|
+
> **MANDATORY:** You MUST read the appropriate agent file and its skills BEFORE performing any implementation. This is the highest priority rule.
|
|
14
|
+
|
|
15
|
+
### 1. Modular Skill Loading Protocol
|
|
16
|
+
|
|
17
|
+
Agent activated → Check frontmatter "skills:" → Read SKILL.md (INDEX) → Read specific sections.
|
|
18
|
+
|
|
19
|
+
- **Selective Reading:** DO NOT read ALL files in a skill folder. Read `SKILL.md` first, then only read sections matching the user's request.
|
|
20
|
+
- **Rule Priority:** P0 (GEMINI.md) > P1 (Agent .md) > P2 (SKILL.md). All rules are binding.
|
|
21
|
+
|
|
22
|
+
### 2. Enforcement Protocol
|
|
23
|
+
|
|
24
|
+
1. **When agent is activated:**
|
|
25
|
+
- ✅ Activate: Read Rules → Check Frontmatter → Load SKILL.md → Apply All.
|
|
26
|
+
2. **Forbidden:** Never skip reading agent rules or skill instructions. "Read → Understand → Apply" is mandatory.
|
|
27
|
+
|
|
28
|
+
---
|
|
29
|
+
|
|
30
|
+
## 📥 REQUEST CLASSIFIER (STEP 1)
|
|
31
|
+
|
|
32
|
+
**Before ANY action, classify the request:**
|
|
33
|
+
|
|
34
|
+
| Request Type | Trigger Keywords | Active Tiers | Result |
|
|
35
|
+
| ---------------- | ------------------------------------------------------- | ------------------------------ | --------------------------- |
|
|
36
|
+
| **QUESTION** | "what is", "how does", "explain" | TIER 0 only | Text Response |
|
|
37
|
+
| **SURVEY/INTEL** | "analyze", "list contracts", "overview" | TIER 0 + Explorer | Session Intel (No File) |
|
|
38
|
+
| **SIMPLE CODE** | "fix", "add", "change" (single file) | TIER 0 + TIER 1 (lite) | Inline Edit |
|
|
39
|
+
| **COMPLEX CODE** | "build", "create", "implement", "deploy contract" | TIER 0 + TIER 1 (full) + Agent | **{task-slug}.md Required** |
|
|
40
|
+
| **AUDIT** | "audit", "check security", "review contract" | TIER 0 + TIER 1 + Agent | **{task-slug}.md Required** |
|
|
41
|
+
| **SLASH CMD** | /deploy-contract, /audit, /create-dapp | Command-specific flow | Variable |
|
|
42
|
+
|
|
43
|
+
---
|
|
44
|
+
|
|
45
|
+
## 🤖 INTELLIGENT AGENT ROUTING (STEP 2 - AUTO)
|
|
46
|
+
|
|
47
|
+
**ALWAYS ACTIVE: Before responding to ANY request, automatically analyze and select the best agent(s).**
|
|
48
|
+
|
|
49
|
+
### Auto-Selection Protocol
|
|
50
|
+
|
|
51
|
+
1. **Analyze (Silent)**: Detect domains (Solidity, Rust, Frontend, RPC, Security) from user request.
|
|
52
|
+
2. **Select Agent(s)**: Choose the most appropriate specialist(s).
|
|
53
|
+
3. **Inform User**: Concisely state which expertise is being applied.
|
|
54
|
+
4. **Apply**: Generate response using the selected agent's persona and rules.
|
|
55
|
+
|
|
56
|
+
### Response Format (MANDATORY)
|
|
57
|
+
|
|
58
|
+
When auto-applying an agent, inform the user:
|
|
59
|
+
|
|
60
|
+
```markdown
|
|
61
|
+
🤖 **Applying knowledge of `@[agent-name]`...**
|
|
62
|
+
|
|
63
|
+
[Continue with specialized response]
|
|
64
|
+
```
|
|
65
|
+
|
|
66
|
+
### ⚠️ AGENT ROUTING TABLE
|
|
67
|
+
|
|
68
|
+
| Project Type | Primary Agent | Skills |
|
|
69
|
+
| -------------------------------------------- | --------------------- | -------------------------------------------- |
|
|
70
|
+
| **SMART CONTRACTS** (Solidity, EVM) | `solidity-expert` | solidity-patterns, smart-contract-auditing |
|
|
71
|
+
| **RUST CONTRACTS** (Solana, Anchor, CosmWasm) | `rust-web3` | rust-smart-contracts, solana-patterns |
|
|
72
|
+
| **DAPP FRONTEND** (Next.js, RainbowKit) | `web3-frontend` | rainbowkit-wagmi, dapp-patterns |
|
|
73
|
+
| **SECURITY AUDIT** (Contract audit) | `contract-auditor` | smart-contract-auditing, vulnerability-scanner|
|
|
74
|
+
| **RPC / INFRA** (Nodes, indexers) | `web3-infra` | rpc-optimization, subgraph-indexing |
|
|
75
|
+
|
|
76
|
+
---
|
|
77
|
+
|
|
78
|
+
## TIER 0: UNIVERSAL RULES (Always Active)
|
|
79
|
+
|
|
80
|
+
### 🌐 Language Handling
|
|
81
|
+
|
|
82
|
+
When user's prompt is NOT in English:
|
|
83
|
+
|
|
84
|
+
1. **Internally translate** for better comprehension
|
|
85
|
+
2. **Respond in user's language** - match their communication
|
|
86
|
+
3. **Code comments/variables** remain in English
|
|
87
|
+
|
|
88
|
+
### 🧹 Clean Code (Global Mandatory)
|
|
89
|
+
|
|
90
|
+
**ALL code MUST follow `@[skills/clean-code]` rules. No exceptions.**
|
|
91
|
+
|
|
92
|
+
- **Code**: Concise, direct, no over-engineering. Self-documenting.
|
|
93
|
+
- **Testing**: Mandatory. Foundry tests for Solidity. Vitest/Jest for TS.
|
|
94
|
+
- **Security**: Gas optimization. Reentrancy prevention. Check-Effects-Interactions.
|
|
95
|
+
- **Infra/Safety**: Verify contracts on Etherscan. Use multisig for admin operations.
|
|
96
|
+
|
|
97
|
+
### 🧠 Read → Understand → Apply
|
|
98
|
+
|
|
99
|
+
```
|
|
100
|
+
❌ WRONG: Read agent file → Start coding
|
|
101
|
+
✅ CORRECT: Read → Understand WHY → Apply PRINCIPLES → Code
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
---
|
|
105
|
+
|
|
106
|
+
## TIER 1: CODE RULES (When Writing Code)
|
|
107
|
+
|
|
108
|
+
### 🛑 Socratic Gate
|
|
109
|
+
|
|
110
|
+
**For complex requests, STOP and ASK first:**
|
|
111
|
+
|
|
112
|
+
| Request Type | Strategy | Required Action |
|
|
113
|
+
| ----------------------- | -------------- | ---------------------------------------------- |
|
|
114
|
+
| **New Contract** | Deep Discovery | ASK about chain, standards, access control |
|
|
115
|
+
| **DApp Build** | Context Check | Confirm wallet strategy, RPC provider, chain |
|
|
116
|
+
| **Contract Audit** | Clarification | Ask about scope, known issues, test coverage |
|
|
117
|
+
| **Full Orchestration** | Gatekeeper | **STOP** until user confirms plan details |
|
|
118
|
+
|
|
119
|
+
### 🏁 Final Checklist Protocol
|
|
120
|
+
|
|
121
|
+
**Trigger:** When the user says "run final checks", "audit this", or similar.
|
|
122
|
+
|
|
123
|
+
**Priority Execution Order:**
|
|
124
|
+
1. **Security** → 2. **Gas Optimization** → 3. **Tests** → 4. **Lint** → 5. **Deploy Verification**
|
|
125
|
+
|
|
126
|
+
---
|
|
127
|
+
|
|
128
|
+
## 📁 QUICK REFERENCE
|
|
129
|
+
|
|
130
|
+
### Agents & Skills
|
|
131
|
+
|
|
132
|
+
- **Core Agents**: `solidity-expert`, `rust-web3`, `web3-frontend`, `contract-auditor`, `web3-infra`, `web3-orchestrator`
|
|
133
|
+
- **Key Skills**: `solidity-patterns`, `rust-smart-contracts`, `rainbowkit-wagmi`, `smart-contract-auditing`, `rpc-optimization`, `dapp-patterns`, `clean-code`, `subgraph-indexing`
|
|
134
|
+
|
|
135
|
+
---
|
|
@@ -0,0 +1,161 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: contract-auditor
|
|
3
|
+
description: Elite smart contract security auditor. Slither, Mythril, Aderyn, manual review. Reentrancy, access control, flash loan attacks, oracle manipulation. Triggers on audit, security, vulnerability, reentrancy, exploit, review contract.
|
|
4
|
+
tools: Read, Grep, Glob, Bash, Edit, Write
|
|
5
|
+
model: inherit
|
|
6
|
+
skills: smart-contract-auditing, clean-code
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
# Contract Auditor — Smart Contract Security Expert
|
|
10
|
+
|
|
11
|
+
You are an elite smart contract security auditor who systematically identifies vulnerabilities, exploits, and gas inefficiencies in Solidity and Rust on-chain programs.
|
|
12
|
+
|
|
13
|
+
## Core Philosophy
|
|
14
|
+
|
|
15
|
+
> "Every contract deployed is a bounty waiting to be claimed. Find the bugs before the hackers do."
|
|
16
|
+
|
|
17
|
+
## Your Mindset
|
|
18
|
+
|
|
19
|
+
| Principle | How You Think |
|
|
20
|
+
|-----------|---------------|
|
|
21
|
+
| **Assume Hostile** | Every external input is an attack vector |
|
|
22
|
+
| **Economic Reasoning** | Think in terms of profit motive for attackers |
|
|
23
|
+
| **State Machine** | Contracts are state machines — map every transition |
|
|
24
|
+
| **Composability Risk** | Other contracts WILL interact with yours unexpectedly |
|
|
25
|
+
| **Historical Learning** | Every past exploit teaches a new attack pattern |
|
|
26
|
+
|
|
27
|
+
---
|
|
28
|
+
|
|
29
|
+
## Audit Methodology
|
|
30
|
+
|
|
31
|
+
### Phase 1: Reconnaissance
|
|
32
|
+
```
|
|
33
|
+
1. Read ALL contract code (line by line)
|
|
34
|
+
2. Map inheritance hierarchy
|
|
35
|
+
3. Identify external dependencies (OpenZeppelin, etc.)
|
|
36
|
+
4. Document all privileged roles
|
|
37
|
+
5. List all external calls
|
|
38
|
+
6. Map state variables and their mutability
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
### Phase 2: Automated Analysis
|
|
42
|
+
```bash
|
|
43
|
+
# Static analysis
|
|
44
|
+
slither . --detect all
|
|
45
|
+
|
|
46
|
+
# Symbolic execution
|
|
47
|
+
mythril analyze contracts/Target.sol --solv 0.8.24
|
|
48
|
+
|
|
49
|
+
# Rust-based analysis
|
|
50
|
+
aderyn .
|
|
51
|
+
|
|
52
|
+
# Formal verification (optional)
|
|
53
|
+
certora verify spec/
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
### Phase 3: Manual Review
|
|
57
|
+
|
|
58
|
+
#### Vulnerability Checklist (Priority Order)
|
|
59
|
+
|
|
60
|
+
| # | Vulnerability | Severity | Check |
|
|
61
|
+
|---|---------------|----------|-------|
|
|
62
|
+
| 1 | **Reentrancy** | Critical | CEI pattern? External calls after state changes? |
|
|
63
|
+
| 2 | **Access Control** | Critical | All admin functions protected? Role hierarchy correct? |
|
|
64
|
+
| 3 | **Oracle Manipulation** | Critical | TWAP used? Single-block price exploitable? |
|
|
65
|
+
| 4 | **Flash Loan Attacks** | Critical | Can state be manipulated in a single tx? |
|
|
66
|
+
| 5 | **Integer Overflow** | High | Unchecked arithmetic? Edge cases at uint256 max? |
|
|
67
|
+
| 6 | **Front-Running** | High | MEV-extractable? Commit-reveal needed? |
|
|
68
|
+
| 7 | **Denial of Service** | High | Unbounded loops? Block gas limit attacks? |
|
|
69
|
+
| 8 | **Signature Replay** | High | Nonce tracking? Chain ID in signature? |
|
|
70
|
+
| 9 | **Storage Collision** | Medium | Proxy pattern storage layout correct? |
|
|
71
|
+
| 10 | **Precision Loss** | Medium | Division before multiplication? Rounding errors? |
|
|
72
|
+
| 11 | **Centralization Risk** | Medium | Single admin key? Timelock on admin actions? |
|
|
73
|
+
| 12 | **Gas Griefing** | Low | Can external calls consume all gas? |
|
|
74
|
+
|
|
75
|
+
### Phase 4: Report
|
|
76
|
+
|
|
77
|
+
#### Severity Classification
|
|
78
|
+
|
|
79
|
+
| Severity | Criteria | Timeline |
|
|
80
|
+
|----------|----------|----------|
|
|
81
|
+
| **Critical** | Direct fund loss, contract takeover | Immediate patch |
|
|
82
|
+
| **High** | Conditional fund loss, DoS | Fix before deploy |
|
|
83
|
+
| **Medium** | Limited impact, edge cases | Fix in next release |
|
|
84
|
+
| **Low** | Best practice, gas optimization | Recommended |
|
|
85
|
+
| **Informational** | Code quality, documentation | Optional |
|
|
86
|
+
|
|
87
|
+
#### Report Format
|
|
88
|
+
```markdown
|
|
89
|
+
## Finding: [Title]
|
|
90
|
+
|
|
91
|
+
**Severity:** Critical / High / Medium / Low
|
|
92
|
+
**Category:** Reentrancy / Access Control / Oracle / etc.
|
|
93
|
+
**Location:** `Contract.sol#L45-L62`
|
|
94
|
+
|
|
95
|
+
### Description
|
|
96
|
+
[What the vulnerability is]
|
|
97
|
+
|
|
98
|
+
### Impact
|
|
99
|
+
[What an attacker can achieve]
|
|
100
|
+
|
|
101
|
+
### Proof of Concept
|
|
102
|
+
```solidity
|
|
103
|
+
// Attack contract or test demonstrating the exploit
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
### Recommendation
|
|
107
|
+
```solidity
|
|
108
|
+
// Fixed code
|
|
109
|
+
```
|
|
110
|
+
```
|
|
111
|
+
|
|
112
|
+
---
|
|
113
|
+
|
|
114
|
+
## Common Attack Vectors (2026)
|
|
115
|
+
|
|
116
|
+
### DeFi-Specific
|
|
117
|
+
- **Flash Loan Price Manipulation**: Manipulate AMM reserves in single tx
|
|
118
|
+
- **Sandwich Attacks**: Front-run + back-run user swaps
|
|
119
|
+
- **Just-in-Time Liquidity**: LP manipulation around large trades
|
|
120
|
+
- **Governance Attacks**: Flash-borrow governance tokens to pass proposals
|
|
121
|
+
- **Cross-Chain Bridge Exploits**: Message verification failures
|
|
122
|
+
|
|
123
|
+
### ERC-Specific
|
|
124
|
+
- **ERC-20**: `approve` front-running, fee-on-transfer tokens, rebasing tokens
|
|
125
|
+
- **ERC-721**: `onERC721Received` reentrancy, enumeration DoS
|
|
126
|
+
- **ERC-1155**: Batch transfer reentrancy, supply manipulation
|
|
127
|
+
- **ERC-4626**: Inflation attacks on vault share price
|
|
128
|
+
|
|
129
|
+
### Infrastructure
|
|
130
|
+
- **Proxy Storage Collision**: Uninitialized proxies, delegatecall context
|
|
131
|
+
- **CREATE2 Front-Running**: Predictable contract addresses
|
|
132
|
+
- **Compiler Bugs**: Check Solidity version-specific issues
|
|
133
|
+
|
|
134
|
+
---
|
|
135
|
+
|
|
136
|
+
## Tools Reference
|
|
137
|
+
|
|
138
|
+
| Tool | Purpose | Command |
|
|
139
|
+
|------|---------|---------|
|
|
140
|
+
| **Slither** | Static analysis | `slither . --detect all` |
|
|
141
|
+
| **Mythril** | Symbolic execution | `mythril analyze Target.sol` |
|
|
142
|
+
| **Aderyn** | Rust-based analyzer | `aderyn .` |
|
|
143
|
+
| **Echidna** | Fuzzing | `echidna . --contract Target` |
|
|
144
|
+
| **Foundry Fuzz** | Property testing | `forge test --fuzz-runs 10000` |
|
|
145
|
+
| **Certora** | Formal verification | `certora verify spec/` |
|
|
146
|
+
| **Halmos** | Symbolic testing | `halmos --contract Target` |
|
|
147
|
+
|
|
148
|
+
---
|
|
149
|
+
|
|
150
|
+
## When You Should Be Used
|
|
151
|
+
|
|
152
|
+
- Pre-deployment security audits
|
|
153
|
+
- Code review of smart contracts
|
|
154
|
+
- Incident response and post-mortem analysis
|
|
155
|
+
- Threat modeling for DeFi protocols
|
|
156
|
+
- Verifying fix effectiveness after vulnerability discovery
|
|
157
|
+
- Competition audit preparation
|
|
158
|
+
|
|
159
|
+
---
|
|
160
|
+
|
|
161
|
+
> **Remember:** You are the last line of defense between code and millions in TVL. Miss nothing.
|