Claude Skills by lifinance

Add an audit report to the audit log by parsing a pasted PDF file

Add a new network to the codebase (networks.json, foundry.toml, permit2Proxy.json, gaszip.json, bridge configs; do not mutate global.json for per-network Permit2/GasZip; target state via scriptMaster)

Analyze a failing transaction by hash and network

Investigate an unverified smart contract end-to-end — given an address (or block-explorer URL) and a network, resolve the RPC, detect EIP-1967 proxies, disassemble with Heimdall, extract every function selector, enrich them via local artifacts / cast / 4byte.directory, and emit one structured markdown report. Use this skill whenever a user mentions an unverified or unknown contract; pastes an etherscan/basescan/arbiscan/etc. URL with no source; asks "what does this contract do" or "what funct...

Personal PR inbox for LI.FI engineers — covers both outgoing PRs (yours) and incoming review queue (others'). Produces a single dry-run dashboard with (a) your OWN open PRs cross-referenced with their #dev-sc-review / #dev-backend-expansion-review Slack threads, split into REMIND-team / YOUR-ACTION / OWN-DRAFTS / STALE, and (b) OTHER developers' PRs posted in those channels that need your attention — unreviewed (potential pick up) or you-reviewed-and-dev-addressed (potential re-review). Alway...

Use when drafting, maintaining, refining, or auditing a structured user-stories catalogue from a product spec + design-review notes + open-questions list. Outputs persona-grouped stories with explicit linkage to unresolved open questions, in a readable format suited for product, engineering, and audit review alike. Trigger on "write user stories for", "draft stories from this spec", "expand the user stories", "add a story for X", "audit the catalogue", "clean up the open questions", "refine t...

Deprecate one or more facet or periphery contracts by removing them from the codebase

Deprecate one or more networks by removing entries from networks.json, foundry.toml, and deployment logs

Post a `lifinance/contracts` pull request to `#dev-sc-review` and enable auto-merge (squash). Top-level message plus a thread reply tagging `@smartcontract_core`. Use when the user says "post PR for review", "send for review", "share for review", "post to dev-sc-review", or supplies a `lifinance/contracts` PR URL with review intent. Requires the Slack MCP server.

Request development funds from the LI.FI `lifinance/automate-wallet-dev-fees` PR-based wallet. Parses a natural-language request (amount, token, chain, optional recipient + justification), resolves chain-name → chainId via `config/networks.json` and recipient → address via `config/global.json` (defaulting to `deployerWallet`), opens a PR appending an entry to `transfers/requests.json`, and pings the current approvers in a PR comment. Use when the user says "request dev funds", "refill deploye...

Review and analyze a Cantina bug bounty report against codebase, docs, audits, scope, and severity

Start work on a Linear ticket — fetches the issue, creates a properly-named local git branch in the right repo, moves the ticket to "In Progress", and assigns it to the current user. Use when the user says "start ticket", "start linear ticket", "begin work on EXSC-XXX", "/start-ticket", "let's start <ID>", or supplies a Linear issue ID/URL with intent to begin work. Mirrors the "Create branch" button from Jira, but also handles the status flip and ownership claim in one step — designed for or...

Standardize adding/updating rules & commands/skills in this repo (scoping, dedupe, naming, DRY symlink structure); use when authoring or revising an agent rule or command.

Standardize adding/updating rules & commands/skills in this repo (scoping, dedupe, naming, DRY symlink structure); use when authoring or revising an agent rule or command.

Full Aikido triage for a PR or repo. In PR scope (default) it reads the aikido-pr-checks[bot] inline review comments on the PR; in repo/single-issue scope it reads the aikido_issues_list feed. Identifies false positives and real findings, ignores false positives (by replying "@AikidoSec ignore:" on the PR comment, or via aikido_ignore_issue for feed scope), applies code fixes for real findings (NoSQL injection, GH Actions template injection, vulnerable dependencies, unpinned Actions), and opt...

Add a new false positive pattern to the Aikido catalog (.agents/references/aikido-false-positive-catalog.md). Analyzes the flagged file to understand why the finding is a false positive, drafts a catalog entry (matches-when, ignore_reason, sast_context), shows it for confirmation, appends it, and commits. Use when Aikido flags something new on a PR that is clearly a false positive not yet in the catalog.

Recurring (weekly) Aikido security-feed review for a repo — pulls all open findings via the Aikido MCP, builds a severity/type dashboard with SLA status, groups findings into action groups with a recommendation each, and lets the USER decide per group (nothing is fixed or ignored without their pick); ends by offering to schedule the next run. For tech leads reviewing their repo's security posture on a cadence, not for triaging a single PR. Use when asked to "review aikido findings", "weekly a...

Verify a wallet rotation / SC-dev offboarding is complete across all active networks — Safe-owner membership (old removed / new added), Timelock CANCELLER_ROLE (old removed / new granted), whitelist permission, staging-diamond `owner()`, and wallet funding (the CI funding check). Generalizes the hardcoded `script/tasks/temp/checkOffboardingStatusPerNetwork.ts` (whose addresses are baked-in module constants) into a reusable, flag-driven check that takes old/new addresses as citty flags — writi...

Produces a single beta typings package that combines several in-flight PRs, so backend/QA can test a flow that needs changes from more than one open feature branch at once. Builds a disposable "DO NOT MERGE" branch that merges the selected PRs on top of main, opens a labeled PR to fire the Types Bindings workflow, captures the exact published beta tag, and returns the version backend pins. Use when someone says "create a merged typings package", "combine PRs X and Y into a types package", "I ...

Create a pull request for the current branch: creates a new branch if needed, commits staged/unstaged changes, pushes, and opens a PR using the repo's pull_request_template.md. Use when the user says "create PR", "open PR", "make a pull request", "push and PR", or similar. Requires a SmartContract-team (EXSC) Linear ticket — assigned and estimated — on every PR; resolves one from context or creates one (auto-assigned, proposed estimate) unless the user explicitly opts out. Leaves reviewer che...

Deploys a facet/periphery contract to Tron (mainnet or Shasta testnet) from the `contracts-tron` fork — the two-repo, TronWeb-based round trip that Foundry's `deployContractToNetworks.sh` cannot run. Use whenever the target network is `tron`/`tronshasta`, whenever `deploy-contract` detects a Tron target and routes here, or when the user says "deploy <Contract> to tron", "redeploy on tron shasta", or "push the Tron USDT bypass fix". Locates or clones the `contracts-tron` checkout, checks the f...

ROUTING GATE (check BEFORE invoking) — resolve the target environment first. A deploy that lands in a PRODUCTION diamond (any mainnet network, unless the user explicitly says staging) is a multisig rollout: invoke `multisig-rollout` instead, even when the request is a bare "deploy <Contract> to <chain>" or "the receiver is missing on <chain>" — the deploy verb does NOT imply this skill. Invoke this skill directly only for staging/testnet targets, or when `multisig-rollout` is already driving ...

Run one or more contract calls atomically from an EOA via an EIP-7702 sponsored transaction — the EOA ("authority") only signs an off-chain authorization while a separate "sponsor" account pays for and sends a single type-4 tx that executes the calls with `msg.sender == authority`, all-or-nothing. Use whenever you need to (a) batch several actions that must succeed or fail together as one EOA (e.g. approve+call, transfer+register, migrate+verify), or (b) get a transaction out of an EOA that C...

Finishes a production multisig rollout after its timelock ops have executed — verifies execution (MongoDB timelock queue + on-chain isOperationDone), closes the #dev-sc-multisig-proposals Slack thread ("Executed" reply + rocket reaction), syncs the diamond logs for the impacted chains onto the rollout PR, and takes that PR through /pr-ready → ready-for-review → /post-pr-for-review. If the ops are executable but the cron hasn't run yet, it dispatches the Timelock Auto Execution workflow and wa...

Reads or writes Tron contract state outside of a deploy — the TronWeb/`troncast` analog of using `cast` on EVM chains. Use whenever the target network is `tron`/`tronshasta` and the user wants to call a view function, send a transaction (transfer, approve, admin call), check/convert an address, or fetch bytecode — e.g. "check the balance on tron", "send TRX to X", "call owner() on the tron diamond", "what's the base58 for this address". Also the routing target when `manage-wallet-funds` or an...

Bridge, swap, or send funds from any wallet whose private key is in `.env`, routing through the LI.FI API. Three modes — `bridge` (move the native gas asset cross-chain, same wallet on both ends), `swap` (same-chain native↔ERC-20 in either direction, same wallet), and `send` (gas asset to a different recipient). Use whenever an agent or engineer needs to move or provision funds for one of our wallets: "the dev wallet is out of gas on BSC", "bridge some ETH to base to test a route", "swap nati...

Move Tron staked-resource (energy/bandwidth) delegation from a rotated-OUT wallet's Tron address to the new wallet's Tron address during a wallet rotation. There is NO repo tooling for this and the delegation is delegator-controlled — the actual undelegate/re-delegate is executed off-repo by the resource-provider wallet holder (Max), not by this skill or any of our keys. This skill derives old+new Tron base58 addresses, drafts the exact move request for the provider, then AFTER the provider e...

Orchestrates a PRODUCTION multisig rollout end-to-end — deploy (via `deploy-contract`), propose-only for already-deployed bytecode, or whitelist sync across chains — then captures Safe proposals, drafts a PR when needed, hands hardware-wallet signing to the user, verifies signatures in MongoDB, and posts the #dev-sc-multisig-proposals Slack thread. Use for "roll out <Facet> vX.Y.Z", "create the diamond cut proposals", "propose cuts for already-deployed X", "re-propose after deleting Safe txs"...

Orchestrates a full smart-contract-team offboarding end-to-end — swaps the departing person out of the multisig and rotates every shared SC-owned wallet they held (deployer, dev, pauser) to freshly generated replacements. v1 is EXECUTE-ONLY: it assumes the Linear ticket tree already exists (modeled on EXSC-558) and runs the rotations; it does NOT create the tickets (that is a fast-follow). Use when the user says "offboard <SC dev>", "run the SC-dev offboarding", or "replace <person> as multis...

Prepares and sends a smart contract audit request to Slack (Sujith or burrasec team); use when a PR is ready for external audit review.

Work through an external auditor's GitHub issues for a contracts PR — discover the audit repo from Slack, load every finding, triage fix-vs-acknowledge in one gate, implement each fix as its own commit on a remediation branch, reply to each issue with "fixed <commit>" or "acknowledged <reason>", then post a Slack wrap-up nudging the auditor and pinging @smartcontract_core to re-review. Use when an audit is completed and the findings live as issues in the auditor's repo.

Rotates the shared SC-owned **Deployer** wallet — `safeOwners[0]` + the Timelock `CANCELLER_ROLE` (and prod timelock executor) — end-to-end: bootstraps the new deployer's gas, swaps the Safe owner and moves the canceller role via Safe proposals, handles Tron, updates config, decommissions the old key, and gates on a completeness check. Thin orchestrator: it CALLS the L1 skills (`sweep-wallet-funds`, `move-tron-delegation`, `update-wallet-config`, `check-rotation-status`) and existing skills (...

Rotates the shared SC-owned **Dev** wallet (the staging LiFiDiamond owner) end-to-end — funds the new wallet, transfers staging diamond ownership old→new, moves the Tron energy delegation, updates config, and gates on a completeness check. Thin orchestrator: it CALLS the L1 skills (`sweep-wallet-funds`, `move-tron-delegation`, `update-wallet-config`, `check-rotation-status`) and existing skills, never reimplements them. Use when the user says "rotate the dev wallet", "replace the staging owne...

Rotates the shared SC-owned Pauser wallet (the emergency-pause EOA that trips EmergencyPauseFacet) by redeploying the facet with the new pauser baked into its constructor and cutting it into every diamond — because pauserWallet is immutable and has no setter, a rotation is a redeploy, not a config write. Use when the user says "rotate the pauser wallet", "repoint the emergency pauser", or "replace the pause EOA". NOT for the deployer wallet (safeOwners[0] + Timelock CANCELLER — that is `rotat...

Sweeps all native gas from a rotated-OUT SC wallet to the new wallet across every active EVM chain, via `script/tasks/moveNativeFundsToNewWallet.ts` — this is how every wallet rotation funds its replacement. Previews per-network balances first (read-only via `cast balance` — the script itself has no dry-run flag), derives the sender from the private key (never `config/global.json`), shows a human-confirmed pre-sweep report, and reports per-network moved/skipped/failed. Use when the user says ...

Opens the PR that updates a rotated SC wallet role in `config/global.json` — both the EVM field (`deployerWallet` / `devWallet` / `pauserWallet`) and its matching `tronWallets.<role>` base58 — deriving the Tron address from the new EVM address via `troncast address to-base58` and cross-checking with the reverse `to-hex`. Use when the user says "update the wallet config", "bump the new deployer/dev/pauser in global.json", "open the config PR for the rotation", or when a `rotate-*` skill reache...

Verify a deployed network's smart contracts on its block explorer and flip the MongoDB `verified` flag for each. Use this skill whenever a user asks to "verify the contracts for <network>", "verify contracts in PR #<N>", verify a fresh deployment on its explorer (blockscout / sourcify / etherscan), or fix contracts that show as unverified after a deploy. Drives the verified, working flow: source the deployment address map, ensure the worktree can compile, loop `verifyContract` over every addr...

Standardize adding/updating rules & commands/skills in this repo (scoping, dedupe, naming, DRY symlink structure); use when authoring or revising an agent rule or command.