codeply-cli 0.3.1 → 0.4.0

package/skills/deep-research/SKILL.md

@@ -1,160 +1,160 @@
----
-name: deep-research
-description: Multi-source deep research using firecrawl and exa MCPs. Searches the web, synthesizes findings, and delivers cited reports with source attribution. Use when the user wants thorough research on any topic with evidence and citations.
-metadata:
-  origin: ECC
----
-
-# Deep Research
-
-> **Drift-prone skill.** Firecrawl/Exa MCP tool names, quotas, and result
-> shapes change. Verify the configured MCP tools and current API docs before
-> promising coverage or quoting live source counts.
-
-Produce thorough, cited research reports from multiple web sources using firecrawl and exa MCP tools.
-
-## When to Activate
-
-- User asks to research any topic in depth
-- Competitive analysis, technology evaluation, or market sizing
-- Due diligence on companies, investors, or technologies
-- Any question requiring synthesis from multiple sources
-- User says "research", "deep dive", "investigate", or "what's the current state of"
-
-## MCP Requirements
-
-At least one of:
-- **firecrawl** — `firecrawl_search`, `firecrawl_scrape`, `firecrawl_crawl`
-- **exa** — `web_search_exa`, `web_search_advanced_exa`, `crawling_exa`
-
-Both together give the best coverage. Configure in `~/.claude.json` or `~/.codex/config.toml`.
-
-## Workflow
-
-### Step 1: Understand the Goal
-
-Ask 1-2 quick clarifying questions:
-- "What's your goal — learning, making a decision, or writing something?"
-- "Any specific angle or depth you want?"
-
-If the user says "just research it" — skip ahead with reasonable defaults.
-
-### Step 2: Plan the Research
-
-Break the topic into 3-5 research sub-questions. Example:
-- Topic: "Impact of AI on healthcare"
-  - What are the main AI applications in healthcare today?
-  - What clinical outcomes have been measured?
-  - What are the regulatory challenges?
-  - What companies are leading this space?
-  - What's the market size and growth trajectory?
-
-### Step 3: Execute Multi-Source Search
-
-For EACH sub-question, search using available MCP tools:
-
-**With firecrawl:**
-```
-firecrawl_search(query: "<sub-question keywords>", limit: 8)
-```
-
-**With exa:**
-```
-web_search_exa(query: "<sub-question keywords>", numResults: 8)
-web_search_advanced_exa(query: "<keywords>", numResults: 5, startPublishedDate: "2025-01-01")
-```
-
-**Search strategy:**
-- Use 2-3 different keyword variations per sub-question
-- Mix general and news-focused queries
-- Aim for 15-30 unique sources total
-- Prioritize: academic, official, reputable news > blogs > forums
-
-### Step 4: Deep-Read Key Sources
-
-For the most promising URLs, fetch full content:
-
-**With firecrawl:**
-```
-firecrawl_scrape(url: "<url>")
-```
-
-**With exa:**
-```
-crawling_exa(url: "<url>", tokensNum: 5000)
-```
-
-Read 3-5 key sources in full for depth. Do not rely only on search snippets.
-
-### Step 5: Synthesize and Write Report
-
-Structure the report:
-
-```markdown
-# [Topic]: Research Report
-*Generated: [date] | Sources: [N] | Confidence: [High/Medium/Low]*
-
-## Executive Summary
-[3-5 sentence overview of key findings]
-
-## 1. [First Major Theme]
-[Findings with inline citations]
-- Key point ([Source Name](url))
-- Supporting data ([Source Name](url))
-
-## 2. [Second Major Theme]
-...
-
-## 3. [Third Major Theme]
-...
-
-## Key Takeaways
-- [Actionable insight 1]
-- [Actionable insight 2]
-- [Actionable insight 3]
-
-## Sources
-1. [Title](url) — [one-line summary]
-2. ...
-
-## Methodology
-Searched [N] queries across web and news. Analyzed [M] sources.
-Sub-questions investigated: [list]
-```
-
-### Step 6: Deliver
-
-- **Short topics**: Post the full report in chat
-- **Long reports**: Post the executive summary + key takeaways, save full report to a file
-
-## Parallel Research with Subagents
-
-For broad topics, use Claude Code's Task tool to parallelize:
-
-```
-Launch 3 research agents in parallel:
-1. Agent 1: Research sub-questions 1-2
-2. Agent 2: Research sub-questions 3-4
-3. Agent 3: Research sub-question 5 + cross-cutting themes
-```
-
-Each agent searches, reads sources, and returns findings. The main session synthesizes into the final report.
-
-## Quality Rules
-
-1. **Every claim needs a source.** No unsourced assertions.
-2. **Cross-reference.** If only one source says it, flag it as unverified.
-3. **Recency matters.** Prefer sources from the last 12 months.
-4. **Acknowledge gaps.** If you couldn't find good info on a sub-question, say so.
-5. **No hallucination.** If you don't know, say "insufficient data found."
-6. **Separate fact from inference.** Label estimates, projections, and opinions clearly.
-
-## Examples
-
-```
-"Research the current state of nuclear fusion energy"
-"Deep dive into Rust vs Go for backend services in 2026"
-"Research the best strategies for bootstrapping a SaaS business"
-"What's happening with the US housing market right now?"
-"Investigate the competitive landscape for AI code editors"
-```
+---
+name: deep-research
+description: Multi-source deep research using firecrawl and exa MCPs. Searches the web, synthesizes findings, and delivers cited reports with source attribution. Use when the user wants thorough research on any topic with evidence and citations.
+metadata:
+  origin: ECC
+---
+
+# Deep Research
+
+> **Drift-prone skill.** Firecrawl/Exa MCP tool names, quotas, and result
+> shapes change. Verify the configured MCP tools and current API docs before
+> promising coverage or quoting live source counts.
+
+Produce thorough, cited research reports from multiple web sources using firecrawl and exa MCP tools.
+
+## When to Activate
+
+- User asks to research any topic in depth
+- Competitive analysis, technology evaluation, or market sizing
+- Due diligence on companies, investors, or technologies
+- Any question requiring synthesis from multiple sources
+- User says "research", "deep dive", "investigate", or "what's the current state of"
+
+## MCP Requirements
+
+At least one of:
+- **firecrawl** — `firecrawl_search`, `firecrawl_scrape`, `firecrawl_crawl`
+- **exa** — `web_search_exa`, `web_search_advanced_exa`, `crawling_exa`
+
+Both together give the best coverage. Configure in `~/.claude.json` or `~/.codex/config.toml`.
+
+## Workflow
+
+### Step 1: Understand the Goal
+
+Ask 1-2 quick clarifying questions:
+- "What's your goal — learning, making a decision, or writing something?"
+- "Any specific angle or depth you want?"
+
+If the user says "just research it" — skip ahead with reasonable defaults.
+
+### Step 2: Plan the Research
+
+Break the topic into 3-5 research sub-questions. Example:
+- Topic: "Impact of AI on healthcare"
+  - What are the main AI applications in healthcare today?
+  - What clinical outcomes have been measured?
+  - What are the regulatory challenges?
+  - What companies are leading this space?
+  - What's the market size and growth trajectory?
+
+### Step 3: Execute Multi-Source Search
+
+For EACH sub-question, search using available MCP tools:
+
+**With firecrawl:**
+```
+firecrawl_search(query: "<sub-question keywords>", limit: 8)
+```
+
+**With exa:**
+```
+web_search_exa(query: "<sub-question keywords>", numResults: 8)
+web_search_advanced_exa(query: "<keywords>", numResults: 5, startPublishedDate: "2025-01-01")
+```
+
+**Search strategy:**
+- Use 2-3 different keyword variations per sub-question
+- Mix general and news-focused queries
+- Aim for 15-30 unique sources total
+- Prioritize: academic, official, reputable news > blogs > forums
+
+### Step 4: Deep-Read Key Sources
+
+For the most promising URLs, fetch full content:
+
+**With firecrawl:**
+```
+firecrawl_scrape(url: "<url>")
+```
+
+**With exa:**
+```
+crawling_exa(url: "<url>", tokensNum: 5000)
+```
+
+Read 3-5 key sources in full for depth. Do not rely only on search snippets.
+
+### Step 5: Synthesize and Write Report
+
+Structure the report:
+
+```markdown
+# [Topic]: Research Report
+*Generated: [date] | Sources: [N] | Confidence: [High/Medium/Low]*
+
+## Executive Summary
+[3-5 sentence overview of key findings]
+
+## 1. [First Major Theme]
+[Findings with inline citations]
+- Key point ([Source Name](url))
+- Supporting data ([Source Name](url))
+
+## 2. [Second Major Theme]
+...
+
+## 3. [Third Major Theme]
+...
+
+## Key Takeaways
+- [Actionable insight 1]
+- [Actionable insight 2]
+- [Actionable insight 3]
+
+## Sources
+1. [Title](url) — [one-line summary]
+2. ...
+
+## Methodology
+Searched [N] queries across web and news. Analyzed [M] sources.
+Sub-questions investigated: [list]
+```
+
+### Step 6: Deliver
+
+- **Short topics**: Post the full report in chat
+- **Long reports**: Post the executive summary + key takeaways, save full report to a file
+
+## Parallel Research with Subagents
+
+For broad topics, use Claude Code's Task tool to parallelize:
+
+```
+Launch 3 research agents in parallel:
+1. Agent 1: Research sub-questions 1-2
+2. Agent 2: Research sub-questions 3-4
+3. Agent 3: Research sub-question 5 + cross-cutting themes
+```
+
+Each agent searches, reads sources, and returns findings. The main session synthesizes into the final report.
+
+## Quality Rules
+
+1. **Every claim needs a source.** No unsourced assertions.
+2. **Cross-reference.** If only one source says it, flag it as unverified.
+3. **Recency matters.** Prefer sources from the last 12 months.
+4. **Acknowledge gaps.** If you couldn't find good info on a sub-question, say so.
+5. **No hallucination.** If you don't know, say "insufficient data found."
+6. **Separate fact from inference.** Label estimates, projections, and opinions clearly.
+
+## Examples
+
+```
+"Research the current state of nuclear fusion energy"
+"Deep dive into Rust vs Go for backend services in 2026"
+"Research the best strategies for bootstrapping a SaaS business"
+"What's happening with the US housing market right now?"
+"Investigate the competitive landscape for AI code editors"
+```

package/skills/defi-amm-security/SKILL.md

@@ -1,167 +1,167 @@
----
-name: defi-amm-security
-description: Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.
-metadata:
-  origin: ECC direct-port adaptation
-version: "1.0.0"
----
-
-# DeFi AMM Security
-
-Critical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions.
-
-## When to Use
-
-- Writing or auditing a Solidity AMM or liquidity-pool contract
-- Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances
-- Reviewing any contract that uses `token.balanceOf(address(this))` in share or reserve math
-- Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol
-
-## How It Works
-
-Use this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants.
-
-## Execution Safety
-
-The shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing/static-analysis jobs that may consume significant local or paid resources.
-
-Never include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports.
-
-## Examples
-
-### Reentrancy: enforce CEI order
-
-Vulnerable:
-
-```solidity
-function withdraw(uint256 amount) external {
-    require(balances[msg.sender] >= amount);
-    token.transfer(msg.sender, amount);
-    balances[msg.sender] -= amount;
-}
-```
-
-Safe:
-
-```solidity
-import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
-import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
-
-using SafeERC20 for IERC20;
-
-function withdraw(uint256 amount) external nonReentrant {
-    require(balances[msg.sender] >= amount, "Insufficient");
-    balances[msg.sender] -= amount;
-    token.safeTransfer(msg.sender, amount);
-}
-```
-
-Do not write your own guard when a hardened library exists.
-
-### Donation or inflation attacks
-
-Using `token.balanceOf(address(this))` directly for share math lets attackers manipulate the denominator by sending tokens to the contract outside the intended path.
-
-```solidity
-// Vulnerable
-function deposit(uint256 assets) external returns (uint256 shares) {
-    shares = (assets * totalShares) / token.balanceOf(address(this));
-}
-```
-
-```solidity
-// Safe
-uint256 private _totalAssets;
-
-function deposit(uint256 assets) external nonReentrant returns (uint256 shares) {
-    uint256 balBefore = token.balanceOf(address(this));
-    token.safeTransferFrom(msg.sender, address(this), assets);
-    uint256 received = token.balanceOf(address(this)) - balBefore;
-
-    shares = totalShares == 0 ? received : (received * totalShares) / _totalAssets;
-    _totalAssets += received;
-    totalShares += shares;
-}
-```
-
-Track internal accounting and measure actual tokens received.
-
-### Oracle manipulation
-
-Spot prices are flash-loan manipulable. Prefer TWAP.
-
-```solidity
-uint32[] memory secondsAgos = new uint32[](2);
-secondsAgos[0] = 1800;
-secondsAgos[1] = 0;
-(int56[] memory tickCumulatives,) = IUniswapV3Pool(pool).observe(secondsAgos);
-int24 twapTick = int24(
-    (tickCumulatives[1] - tickCumulatives[0]) / int56(uint56(30 minutes))
-);
-uint160 sqrtPriceX96 = TickMath.getSqrtRatioAtTick(twapTick);
-```
-
-### Slippage protection
-
-Every swap path needs caller-provided slippage and a deadline.
-
-```solidity
-function swap(
-    uint256 amountIn,
-    uint256 amountOutMin,
-    uint256 deadline
-) external returns (uint256 amountOut) {
-    require(block.timestamp <= deadline, "Expired");
-    amountOut = _calculateOut(amountIn);
-    require(amountOut >= amountOutMin, "Slippage exceeded");
-    _executeSwap(amountIn, amountOut);
-}
-```
-
-### Safe reserve math
-
-```solidity
-import {FullMath} from "@uniswap/v3-core/contracts/libraries/FullMath.sol";
-
-uint256 result = FullMath.mulDiv(a, b, c);
-```
-
-For large reserve math, avoid naive `a * b / c` when overflow risk exists.
-
-### Admin controls
-
-```solidity
-import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
-
-contract MyAMM is Ownable2Step {
-    function setFee(uint256 fee) external onlyOwner { ... }
-    function pause() external onlyOwner { ... }
-}
-```
-
-Prefer explicit acceptance for ownership transfer and gate every privileged path.
-
-## Security Checklist
-
-- Reentrancy-exposed entrypoints use `nonReentrant`
-- CEI ordering is respected
-- Share math does not depend on raw `balanceOf(address(this))`
-- ERC-20 transfers use `SafeERC20`
-- Deposits measure actual tokens received
-- Oracle reads use TWAP or another manipulation-resistant source
-- Swaps require `amountOutMin` and `deadline`
-- Overflow-sensitive reserve math uses safe primitives like `mulDiv`
-- Admin functions are access-controlled
-- Emergency pause exists and is tested
-- Static analysis and fuzzing are run before production
-
-## Audit Tools
-
-```bash
-pip install slither-analyzer
-slither . --exclude-dependencies
-
-echidna-test . --contract YourAMM --config echidna.yaml
-
-forge test --fuzz-runs 10000
-```
+---
+name: defi-amm-security
+description: Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.
+metadata:
+  origin: ECC direct-port adaptation
+version: "1.0.0"
+---
+
+# DeFi AMM Security
+
+Critical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions.
+
+## When to Use
+
+- Writing or auditing a Solidity AMM or liquidity-pool contract
+- Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances
+- Reviewing any contract that uses `token.balanceOf(address(this))` in share or reserve math
+- Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol
+
+## How It Works
+
+Use this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants.
+
+## Execution Safety
+
+The shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing/static-analysis jobs that may consume significant local or paid resources.
+
+Never include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports.
+
+## Examples
+
+### Reentrancy: enforce CEI order
+
+Vulnerable:
+
+```solidity
+function withdraw(uint256 amount) external {
+    require(balances[msg.sender] >= amount);
+    token.transfer(msg.sender, amount);
+    balances[msg.sender] -= amount;
+}
+```
+
+Safe:
+
+```solidity
+import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+
+using SafeERC20 for IERC20;
+
+function withdraw(uint256 amount) external nonReentrant {
+    require(balances[msg.sender] >= amount, "Insufficient");
+    balances[msg.sender] -= amount;
+    token.safeTransfer(msg.sender, amount);
+}
+```
+
+Do not write your own guard when a hardened library exists.
+
+### Donation or inflation attacks
+
+Using `token.balanceOf(address(this))` directly for share math lets attackers manipulate the denominator by sending tokens to the contract outside the intended path.
+
+```solidity
+// Vulnerable
+function deposit(uint256 assets) external returns (uint256 shares) {
+    shares = (assets * totalShares) / token.balanceOf(address(this));
+}
+```
+
+```solidity
+// Safe
+uint256 private _totalAssets;
+
+function deposit(uint256 assets) external nonReentrant returns (uint256 shares) {
+    uint256 balBefore = token.balanceOf(address(this));
+    token.safeTransferFrom(msg.sender, address(this), assets);
+    uint256 received = token.balanceOf(address(this)) - balBefore;
+
+    shares = totalShares == 0 ? received : (received * totalShares) / _totalAssets;
+    _totalAssets += received;
+    totalShares += shares;
+}
+```
+
+Track internal accounting and measure actual tokens received.
+
+### Oracle manipulation
+
+Spot prices are flash-loan manipulable. Prefer TWAP.
+
+```solidity
+uint32[] memory secondsAgos = new uint32[](2);
+secondsAgos[0] = 1800;
+secondsAgos[1] = 0;
+(int56[] memory tickCumulatives,) = IUniswapV3Pool(pool).observe(secondsAgos);
+int24 twapTick = int24(
+    (tickCumulatives[1] - tickCumulatives[0]) / int56(uint56(30 minutes))
+);
+uint160 sqrtPriceX96 = TickMath.getSqrtRatioAtTick(twapTick);
+```
+
+### Slippage protection
+
+Every swap path needs caller-provided slippage and a deadline.
+
+```solidity
+function swap(
+    uint256 amountIn,
+    uint256 amountOutMin,
+    uint256 deadline
+) external returns (uint256 amountOut) {
+    require(block.timestamp <= deadline, "Expired");
+    amountOut = _calculateOut(amountIn);
+    require(amountOut >= amountOutMin, "Slippage exceeded");
+    _executeSwap(amountIn, amountOut);
+}
+```
+
+### Safe reserve math
+
+```solidity
+import {FullMath} from "@uniswap/v3-core/contracts/libraries/FullMath.sol";
+
+uint256 result = FullMath.mulDiv(a, b, c);
+```
+
+For large reserve math, avoid naive `a * b / c` when overflow risk exists.
+
+### Admin controls
+
+```solidity
+import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
+
+contract MyAMM is Ownable2Step {
+    function setFee(uint256 fee) external onlyOwner { ... }
+    function pause() external onlyOwner { ... }
+}
+```
+
+Prefer explicit acceptance for ownership transfer and gate every privileged path.
+
+## Security Checklist
+
+- Reentrancy-exposed entrypoints use `nonReentrant`
+- CEI ordering is respected
+- Share math does not depend on raw `balanceOf(address(this))`
+- ERC-20 transfers use `SafeERC20`
+- Deposits measure actual tokens received
+- Oracle reads use TWAP or another manipulation-resistant source
+- Swaps require `amountOutMin` and `deadline`
+- Overflow-sensitive reserve math uses safe primitives like `mulDiv`
+- Admin functions are access-controlled
+- Emergency pause exists and is tested
+- Static analysis and fuzzing are run before production
+
+## Audit Tools
+
+```bash
+pip install slither-analyzer
+slither . --exclude-dependencies
+
+echidna-test . --contract YourAMM --config echidna.yaml
+
+forge test --fuzz-runs 10000
+```