@elizaos/skills 2.0.0-alpha.3

package/skills/security-entry-point-analyzer/skills/entry-point-analyzer/references/ton.md

@@ -0,0 +1,185 @@
+# TON Entry Point Detection (FunC/Tact)
+
+## Entry Point Identification (State-Changing Only)
+
+Focus on message handlers that modify state. **Exclude** read-only patterns:
+- `get` methods in FunC (pure getters)
+- Receivers that only return data without state changes
+
+### FunC Entry Points
+```func
+;; Main entry point - receives all external messages
+() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {
+    ;; Dispatch based on op code
+    int op = in_msg_body~load_uint(32);
+    if (op == op::transfer) { handle_transfer(); }
+}
+
+;; External messages (from outside blockchain)
+() recv_external(slice in_msg) impure {
+    ;; Usually for wallet operations
+}
+
+;; Tick-tock for special contracts
+() run_ticktock(cell full_state, int is_tock) impure {
+}
+```
+
+### Tact Entry Points
+```tact
+contract MyContract {
+    // Receivers are entry points
+    receive(msg: Transfer) {
+        // Handle Transfer message
+    }
+    
+    receive("increment") {
+        // Handle text message
+    }
+    
+    // External receiver
+    external(msg: Deploy) {
+        // Handle external message
+    }
+    
+    // Bounce handler
+    bounced(src: bounced<Transfer>) {
+        // Handle bounced message
+    }
+}
+```
+
+### Entry Point Types
+| Pattern | Include? | Notes |
+|---------|----------|-------|
+| `recv_internal` | **Yes** | All internal messages (state-changing) |
+| `recv_external` | **Yes** | External (off-chain) messages |
+| `receive(MsgType)` | **Yes** | Tact message handler |
+| `external(MsgType)` | **Yes** | Tact external handler |
+| `bounced(...)` | **Yes** | Bounce handler |
+| `get` methods (FunC) | No | EXCLUDE - read-only getters |
+| `get fun` (Tact) | No | EXCLUDE - read-only getters |
+| Helper functions | No | Internal only |
+
+## Access Control Patterns
+
+### FunC Access Control
+```func
+;; Owner check
+() check_owner() impure inline {
+    throw_unless(401, equal_slices(sender_address, owner_address));
+}
+
+;; Admin check via stored address
+() require_admin() impure inline {
+    var ds = get_data().begin_parse();
+    slice admin = ds~load_msg_addr();
+    throw_unless(403, equal_slices(sender_address, admin));
+}
+```
+
+### Tact Access Control
+```tact
+contract Owned {
+    owner: Address;
+    
+    receive(msg: AdminAction) {
+        require(sender() == self.owner, "Not owner");
+        // ...
+    }
+    
+    // Using traits
+    receive(msg: Transfer) {
+        self.requireOwner();  // From Ownable trait
+        // ...
+    }
+}
+```
+
+### Op Code Dispatch Pattern (FunC)
+```func
+() recv_internal(...) impure {
+    int op = in_msg_body~load_uint(32);
+    
+    ;; Public operations
+    if (op == op::transfer) { return handle_transfer(); }
+    if (op == op::swap) { return handle_swap(); }
+    
+    ;; Admin operations
+    if (op == op::set_fee) {
+        check_owner();
+        return handle_set_fee();
+    }
+}
+```
+
+### Access Control Classification
+| Pattern | Classification |
+|---------|----------------|
+| `equal_slices(sender, owner)` | Owner |
+| `equal_slices(sender, admin)` | Admin |
+| `require(sender() == self.owner)` | Owner |
+| `self.requireOwner()` | Owner |
+| `throw_unless(X, equal_slices(...))` | Check error code context |
+| No sender check for op code | Public (Unrestricted) |
+
+## Contract-Only Detection
+
+### Callback Patterns
+```func
+;; Jetton transfer notification
+() on_jetton_transfer(...) impure {
+    ;; Should verify sender is jetton wallet
+}
+
+;; NFT callbacks
+() on_nft_transfer(...) impure {
+}
+```
+
+### Contract Verification
+```func
+;; Verify caller is expected contract
+() verify_caller(slice expected) impure inline {
+    throw_unless(402, equal_slices(sender_address, expected));
+}
+```
+
+## Extraction Strategy
+
+### FunC
+1. Parse `.fc` / `.func` files
+2. Find `recv_internal` and `recv_external` functions
+3. Extract op code dispatch table:
+   - Map op codes to handler functions
+   - Check each handler for owner/admin checks
+4. Classify:
+   - Op codes with no access check → Public
+   - Op codes with `check_owner`/similar → Role-based
+   - Callbacks → Contract-Only
+
+### Tact
+1. Parse `.tact` files
+2. Find `contract` declarations
+3. Extract all `receive`, `external`, `bounced` handlers
+   - **Skip** `get fun` declarations (read-only getters)
+4. Check handler body for:
+   - `require(sender() == self.X)` → Role-based
+   - `self.requireOwner()` → Owner
+   - No sender validation → Public (Unrestricted)
+
+## TON-Specific Considerations
+
+1. **Message-Based**: All interactions are via messages with op codes
+2. **Workchains**: Check if contract operates on specific workchain
+3. **Bounced Messages**: Handle bounced messages appropriately
+4. **Gas Management**: `accept_message()` in FunC accepts gas payment
+5. **State Init**: Initial deployment may set owner/admin
+
+## Common Gotchas
+
+1. **Op Code Collisions**: Different contracts may use same op codes
+2. **Proxy Patterns**: Some contracts forward messages
+3. **Wallet Contracts**: Special access control for wallet operations
+4. **Masterchain**: Some operations require masterchain deployment
+5. **Query ID**: Track request/response with query_id

package/skills/security-entry-point-analyzer/skills/entry-point-analyzer/references/vyper.md

@@ -0,0 +1,141 @@
+# Vyper Entry Point Detection
+
+## Entry Point Identification (State-Changing Only)
+
+### Include: State-Changing Functions
+```vyper
+@external                    # State-changing entry point
+def function_name():
+    pass
+
+@external
+@payable                     # State-changing, receives ETH
+def payable_function():
+    pass
+
+@external
+@nonreentrant("lock")        # State-changing with reentrancy protection
+def protected():
+    pass
+```
+
+### Exclude: Read-Only Functions
+```vyper
+@external
+@view                        # EXCLUDE - cannot modify state
+def read_only():
+    pass
+
+@external
+@pure                        # EXCLUDE - no state access
+def pure_function():
+    pass
+```
+
+### Decorator Matrix
+| Decorators | Include? | Notes |
+|------------|----------|-------|
+| `@external` | **Yes** | State-changing entry point |
+| `@external @payable` | **Yes** | State-changing, receives ETH |
+| `@external @nonreentrant` | **Yes** | State-changing with protection |
+| `@external @view` | No | Read-only, exclude |
+| `@external @pure` | No | No state access, exclude |
+| `@internal` | No | Not externally callable |
+| `@deploy` | No | Constructor (Vyper 0.4+) |
+
+### Special Entry Points
+```vyper
+@external
+@payable
+def __default__():           # Fallback function (receives ETH + unmatched calls)
+    pass
+```
+
+## Access Control Patterns
+
+### Owner Pattern
+```vyper
+owner: public(address)
+
+@external
+def restricted_function():
+    assert msg.sender == self.owner, "Not owner"
+    # ...
+```
+
+### Role-Based Patterns
+```vyper
+# Common patterns
+admin: public(address)
+governance: public(address)
+guardian: public(address)
+operator: public(address)
+
+# Mapping-based roles
+authorized: public(HashMap[address, bool])
+minters: public(HashMap[address, bool])
+
+@external
+def mint(to: address, amount: uint256):
+    assert self.minters[msg.sender], "Not minter"
+    # ...
+```
+
+### Access Control Classification
+| Pattern | Classification |
+|---------|----------------|
+| `assert msg.sender == self.owner` | Admin/Owner |
+| `assert msg.sender == self.admin` | Admin |
+| `assert msg.sender == self.governance` | Governance |
+| `assert msg.sender == self.guardian` | Guardian |
+| `assert self.authorized[msg.sender]` | Review Required |
+| `assert self.whitelist[msg.sender]` | Review Required |
+
+## Contract-Only Detection
+
+### Callback Functions
+```vyper
+@external
+def onERC721Received(...) -> bytes4:
+    return method_id("onERC721Received(address,address,uint256,bytes)")
+
+@external
+def uniswapV3SwapCallback(amount0: int256, amount1: int256, data: Bytes[...]):
+    # Must verify caller is the pool
+    pass
+```
+
+### Contract-Caller Checks
+```vyper
+assert msg.sender == self.pool, "Only pool"
+assert msg.sender != tx.origin, "No EOA"  # Vyper 0.3.7+
+```
+
+## Extraction Strategy
+
+1. Parse all `.vy` files
+2. For each function:
+   - Check for `@external` decorator
+   - **Skip** functions with `@view` or `@pure` decorators
+   - Record function name and parameters
+   - Record line number
+   - Check for access control assertions in function body
+3. Classify:
+   - No access assertions → Public (Unrestricted)
+   - `msg.sender == self.X` → Check what X is
+   - `self.mapping[msg.sender]` → Review Required
+   - Known callback name → Contract-Only
+
+## Vyper-Specific Considerations
+
+1. **No Modifiers**: Vyper doesn't have modifiers—access control is inline `assert` statements
+2. **No Inheritance**: Each contract is standalone (interfaces only)
+3. **Explicit is Better**: All visibility must be declared explicitly
+4. **Default Internal**: Functions without decorators are internal
+
+## Common Gotchas
+
+1. **Initializer Pattern**: Look for `initialized: bool` flag with one-time setup
+2. **Raw Calls**: `raw_call()` can delegate to other contracts
+3. **Create Functions**: `create_minimal_proxy_to()`, `create_copy_of()` are factory patterns
+4. **Reentrancy**: `@nonreentrant` protects against reentrancy but function is still entry point

package/skills/security-firebase-apk-scanner/.claude-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "firebase-apk-scanner",
+  "version": "2.1.0",
+  "description": "Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.",
+  "author": {
+    "name": "Nick Sellier",
+    "email": "",
+    "url": ""
+  }
+}

package/skills/security-firebase-apk-scanner/README.md

@@ -0,0 +1,85 @@
+# Firebase APK Security Scanner
+
+Scan Android APKs for Firebase security misconfigurations including open databases, exposed storage buckets, and authentication bypasses.
+
+## When to Use
+
+Use this skill when you need to:
+- Audit Android applications for Firebase misconfigurations
+- Test Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
+- Check authentication security (open signup, anonymous auth, email enumeration)
+- Enumerate Cloud Functions and test for unauthenticated access
+- Perform mobile app security assessments involving Firebase backends
+
+## When NOT to Use
+
+- Scanning apps you do not have explicit authorization to test
+- Testing production Firebase projects without written permission
+- When you only need to extract Firebase config without testing (use manual grep/strings instead)
+- For non-Android targets (iOS, web apps) - this skill is APK-specific
+- When the target app does not use Firebase
+
+## What It Does
+
+This skill automates Firebase security testing for Android applications. When invoked, Claude will:
+
+- **Decompile** the APK using apktool
+- **Extract** Firebase configuration from all sources (google-services.json, XML resources, assets, smali code, DEX strings)
+- **Test** authentication endpoints for misconfigurations
+- **Probe** Realtime Database and Firestore for open read/write access
+- **Check** Storage buckets for public listing and upload vulnerabilities
+- **Enumerate** Cloud Functions and test accessibility
+- **Generate** detailed reports with findings and remediation guidance
+
+## Key Features
+
+- Supports native Android, React Native, Flutter, and Cordova apps
+- Extracts config from 7+ sources including raw DEX binary strings
+- Tests 14 distinct vulnerability categories
+- Automatic cleanup of test data created during scans
+- Detailed vulnerability reference documentation included
+
+## Installation
+
+```
+/plugin install trailofbits/skills/plugins/firebase-apk-scanner
+```
+
+## Prerequisites
+
+Install required dependencies before use:
+
+**macOS:**
+```bash
+brew install apktool curl jq binutils
+```
+
+**Ubuntu/Debian:**
+```bash
+sudo apt install apktool curl jq unzip binutils
+```
+
+## Usage
+
+```
+/firebase-scan ./app.apk
+/firebase-scan ./apks/
+```
+
+Or run the standalone script directly:
+
+```bash
+./scanner.sh app.apk
+./scanner.sh ./apks/ --no-cleanup
+```
+
+## Vulnerability Categories
+
+| Category | Tests | Severity |
+|----------|-------|----------|
+| **Authentication** | Open signup, anonymous auth, email enumeration | Critical/High/Medium |
+| **Realtime Database** | Unauthenticated read/write, auth token bypass | Critical/High |
+| **Firestore** | Document access, collection enumeration | Critical/High |
+| **Storage** | Bucket listing, unauthenticated upload | Critical/High |
+| **Cloud Functions** | Unauthenticated access, function enumeration | Medium/Low |
+| **Remote Config** | Public parameter exposure | Medium |

package/skills/security-firebase-apk-scanner/commands/scan-apk.md

@@ -0,0 +1,18 @@
+---
+name: trailofbits:scan-apk
+description: Scans Android APKs for Firebase security misconfigurations
+argument-hint: "<apk-file-or-directory>"
+allowed-tools:
+  - Bash
+  - Read
+  - Grep
+  - Glob
+---
+
+# Scan APK for Firebase Misconfigurations
+
+**Arguments:** $ARGUMENTS
+
+Parse the APK path from arguments. If empty, ask for the path.
+
+Invoke the `firebase-apk-scanner` skill with the APK path for the full workflow.