Claude Skills by nuroctane

Formal/symbolic properties on Solidity with Halmos, solc SMTChecker, Certora CVL, and Kontrol. Use when fuzzing is not enough for a conservation law. Slow path, like Mythril.

Property-based fuzzing of Solidity with Echidna (Trail of Bits) and Medusa (Crytic) as a complement to Foundry invariants. Use when forge invariant handlers are not enough or the repo already has Echidna properties.

Historical smart-contract vulnerability library across EVM L1/L2, Solana, Move, Cosmos/IBC, Cairo, Bitcoin-adjacent, other VMs, plus zachxbt/tayvano ops vs code. Use for bounty-class mapping, public incident lookup, and in-scope review seeds. Lawful/whitehat only. Load one reference slice, never the whole pack.

Route Immunefi/X-linked paid writeups to the matching protocol playbook. Use for bounty intel, whitehat payouts, Immunefi bugfix reviews, and X-announced crits. Lawful/in-scope only. Load one reference slice, never the whole pack.

Turn deception-program tripwires into identified attackers and lawful outcomes: tripwire event schemas and telemetry, attribution and evidence-pack standards (zachxbt-class dossier discipline, exchange/FBI/SEAL handoff), and the graduated response ladder from observe to freeze-to-handoff. Use when a honeypot, canary, or bait fires, or to design the response side of a deception program. Lawful handoff only - no hack-back.

Read-only on-chain recon for verified Solidity: cast, Sourcify, storage layout, public transaction traces. Use before an in-scope audit or to reconstruct an already-mined incident. Never broadcast, never unlock wallets.

Offchain deception for AI-agent attackers of DeFi protocols: landing-surface design (decoy docs, bait search results, fake internal runbooks, robots.txt lures, decoy repos and RPCs), per-channel watermarking so exploits reveal their source, and planner-poisoning ops (misleading layouts, ABIs, addresses). Pairs with deploying-contract-honeypots. Lawful/defender-owned surfaces only. Load one reference slice.

Turn already-public DeFi incidents (rekt, DeFiHackLabs, BlockSec) into Foundry regression tests. Use for learning and for pinning a similar pattern on in-scope code. Never replay against live funds.

Training path for a whitehat smart-contract researcher: Ethernaut, Damn Vulnerable DeFi, Cyfrin Updraft, Secureum, RareSkills, Paradigm CTF, then in-scope contests. Always as Foundry tests.

Review Solidity access control: missing modifiers, tx.origin, initialize front-run, role rugging, default-public, and two-step ownership. Use on every admin, mint, upgrade, and withdraw path.

Review AMM and concentrated-liquidity pools: k-invariant, callbacks, fee-on-transfer, empty pool, tick math, and spoofed swap callbacks. Use for Uniswap-style, stableswap, and custom AMMs.

Review Bitcoin Script, Lightning HTLCs, Stacks Clarity, BitVM/Babylon challenge games, and EVM-on-Bitcoin sidechains. Use when the VM is not Solidity. Lawful/in-scope only.

Review token bridges and cross-chain messages: replay, decoder, finality, aliasing, amount inflation, and unauthorized mint. Use for lock/mint, burn/mint, LayerZero, Optimism messenger, zk bridges.

Review Cairo/Starknet contracts: u256 rounding, felt vs u256, account/session keys, L1-L2 messages. Use for Starknet DeFi (e.g. Vesu-class rounding). Lawful/in-scope only.

Review Cosmos SDK modules, IBC (ICS-20/23), ibc-hooks, CosmWasm submessages, Authz, Ante/fees. Use for appchains and IBC-connected DeFi. Lawful/in-scope only.

Review compositions of otherwise-safe functions in one transaction: deposit+borrow, harvest+redeem, vote+queue. Use when unit tests pass but invariants fail on sequences. The handler skill is the test harness.

Review ERC-4626 and vault share math for inflation, donation, first-depositor, rounding, and fee-on-transfer. Use for yield vaults, tokenized strategies, and convertToShares/convertToAssets paths.

Review wallets, Safe modules, Permit2, EIP-712 UIs, and signer runbooks for phishing-class bugs (Bybit Safe UI, drainers, leftover approvals). Use when the loss class is ops/frontend, not vault math. Lawful/in-scope only.

Review Governor, timelock, and upgrade-via-governance: delay bypass, proposal hijack, snapshot vs flashloan votes, queue/execute hash mismatch. Use for OZ Governor, custom DAOs, and admin multisigs.

Review L2 assumptions: sequencer downtime, Chainlink sequencer uptime, address aliasing, delayed inbox, custom gas tokens, and optimistic finality windows. Use for OP/Arbitrum/Base/zk and any protocol that reads L1 state from L2.

Review lending markets, CDPs, and liquidations: LTV, oracle, interest index, liquidation bonus, bad debt, and self-liquidation. Use for money markets and isolated pools.

Chain-specific audit surfaces for every major chain by current volume and TVL: Ethereum mainnet, Base, Arbitrum One + Orbit (incl. Robinhood Chain), OP Mainnet + Superchain, Hyperliquid HyperCore/HyperEVM, Solana, BNB Chain, Linea, Scroll, zkSync Era, Sonic, Berachain, Monad, Plasma, Sui, Aptos, TON, TRON, and more. Use when reviewing or deploying code on a named chain, checking precompile / fee / oracle / bridge deltas, or asking what is different about auditing there. Load one reference slice.

Review MEV, ordering, and slippage: missing minOut/deadline, approve races, auction sniping, commit-reveal skips. Use for AMMs, launches, Dutch auctions, and any tx-order-sensitive value path. Analysis only - no sandwiching.

Review Aptos/Sui/Movement Move modules: borrow_global address, shared-object ACL, abilities, capabilities, PTB composition, halt/DoS. Use for Move programs. Lawful/in-scope only.

Review NFT and marketplace contracts: safeTransfer callbacks, royalty bypass, listing signature replay, payment token weirdness, and enumeration grief. Use for ERC-721/1155 markets and launchpads.

Review DeFi price oracles and share/rate math for flash-loan, staleness, sequencer, and first-depositor manipulation. Use for vaults, lending, liquidations, and any contract that reads a spot price.

Review reentrancy and token/AMM callbacks: classic, cross-function, read-only, ERC-777/721/1155 hooks, Uniswap callbacks, failed-call DoS. Use on any value-moving Solidity that makes external calls.

Review EIP-712, permit, and custom signatures: replay, chainId, nonce, deadline, ecrecover address(0), malleability, encodePacked collisions. Use for permits, listings, votes, and bridge attestations.

Review Solana/SVM programs: missing signer, account confusion, arbitrary CPI, PDA bumps, sysvar spoof, close/reinit, Token-2022 hooks. Use for Anchor/native programs and SVM L2s. Lawful/in-scope only.

Review ERC-20/721/1155 integration footguns: fee-on-transfer, rebasing, missing return, approve race, weird decimals, ERC-777/721 hooks. Use whenever a protocol talks to arbitrary tokens.

Review upgradeable Solidity proxies (UUPS, transparent, beacon) for storage-layout clashes, unprotected initialize, missing initializer lock, and implementation suicide. Use before shipping or auditing proxies.

Manual smart-contract review against Solodit historical findings and SWC weakness IDs by protocol type (vault, AMM, bridge, governance). Use after static analysis, before writing a contest report.

Router for whitehat smart-contract security research. Use for DeFi audits, Immunefi/Code4rena/Cantina/Sherlock contests, invariants, oracles, proxies, bridges, lending, AMMs, vaults, and responsible disclosure. Lawful/in-scope only. Never load the whole pack.

Run and triage Slither, Aderyn, Semgrep Solidity rules, and Wake on a Foundry/Hardhat repo. Use as the fast static layer before invariants. Complements auditing-foundry-smart-contract-security.

Dedupe and rank Slither/Aderyn/Mythril/fuzz hits: (file, line), SWC, exploitability x funds, false positives, known issues. Use before writing a contest report.

Write Foundry invariant tests with handler contracts, ghost variables, and actor rotation. Use when a vault, AMM, or any value-moving Solidity contract only has unit tests.

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or r...

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.

'Analyzes bootkit and advanced rootkit malware infecting the Master

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.