contracts-overview
Smart contract audit lane — Solidity/EVM pattern scanner, Slither ingestion, Foundry PoC generation, DeFi attack playbooks.
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Smart contract audit lane — Solidity/EVM pattern scanner, Slither ingestion, Foundry PoC generation, DeFi attack playbooks.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Environment diagnostic skill for SenseNova-Skills project. Checks that sn-image-base is properly installed and configured, validates dependencies and environment variables. Prompts user to configure missing required variables and saves them to .env file. After configuration, reloads environment and suggests agent restart if needed.
Environment diagnostic for the PPT family. Validates sn-image-base, API keys, Node runtime, and optional deps; interactively writes .env for required vars. Runs before sn-ppt-entry; does not modify sn-image-* skills.
Multi-role code review. Orchestrates technical, product, and risk analysis roles into a single consolidated report. Use when asked to do a full review of a pull request, branch, or code changes.
Product review for changes. Assesses DoD alignment, user impact, completeness, and consistency with werf/nelm product behavior. Use alongside technical review for a full picture.
Risk analysis for changes. Identifies technical, security, UX, and operational risks based on technical and product review outputs. Produces a risk analysis table.
Codebase-specific smell catalog with calibrated grep recipes: duck-typing at boundaries, yargs argv re-assertions, value-discarding promise tails, console.* in library code, exhaustive `never` over-broad unions, single-method `Pick` deps, `*Like` boundary shape copies. Use for a periodic audit pass, scoping a cleanup PR, after a major refactor, or reviewing a primitive's consumers. Pairs with refactoring (fix mechanics) and post-implementation-review (second-read hub).
Detect and collapse production code that was split into two pieces (a 'pure' inner function and a thin wrapper/handler/component that calls it) for the single purpose of letting a unit test reach the inner piece. The smell is structure shaped by the test suite, not by the system. Use when reviewing a helper paired with a `.test.ts` of similar or greater size, when an exported function has exactly one production caller next door, when a function takes optional `deps` whose only non-default value lives in the test, when a getter/setter pair injects state the production code already owns, or when the user says "is this earning its keep", "why is this exported", "trace the callers", "is this split for the test", "the test is shaping the API", "could this be one function". Prefer cohesion over unit-testability; pay the regression-coverage cost a different way (integration tests, type safety, deletion).
Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.