How to use the Blockchain Contract Attack agent skill

What the skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a task matches them. This one contains a SKILL.md file with a checklist for reviewing smart contracts and blockchain systems. Its description says it is used when auditing smart contracts, DeFi, or blockchain attack surfaces.

The checklist names specific weaknesses to look for: reentrancy (external calls that send value before state is updated, which the file notes breaks the checks-effects-interactions pattern), missing access control such as absent onlyOwner checks, integer overflow in Solidity versions below 0.8 without SafeMath, oracle price manipulation through flash loans, predictable randomness where block.timestamp can be influenced, and abuse of token approvals such as unlimited approve or permit replay. It also lists DeFi attack types like sandwich attacks, governance attacks and signature replay, cross-chain bridge issues such as signature threshold bypass, and exposed blockchain RPC endpoints on port 8545 that accept eth_sendTransaction.

What you need before you start

The skill itself only adds guidance. To use the tooling it points to, you need to set up the following yourself. The file mentions an Etherscan API key for the getsourcecode lookup, which the agent uses to pull verified contract source code. It also refers to static analysis tools: Slither, Mythril, and/or Manticore, which must be installed separately.

The file does not include those tools or the API key, and it does not contain a step-by-step audit method.

• An Etherscan API key, needed for the getsourcecode lookup
• Slither, Mythril, and/or Manticore installed for static analysis
• An agent environment that supports Agent Skills, such as the Claude apps or Claude Code

Install the skill

Download the skill ZIP from this page. You can install it in one of two ways.

For Claude Code, unzip the download into your personal skills folder at ~/.claude/skills/ so it is available in every project. To limit it to one project, unzip it into that project's .claude/skills/ folder instead.

In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

Trigger the skill with natural requests

You do not need a special command. The skill is meant to load when your request is about auditing smart contracts, DeFi protocols, or blockchain attack surfaces. Describe the job in plain language and name the contract or system you are authorized to review.

Useful phrasing includes the target, the kind of review, and the scope. Mention the weaknesses you care about, such as reentrancy or flash loan price manipulation, so the agent focuses the checklist on those areas.

• Review this Solidity contract for reentrancy and missing access control. I am authorized to test it.
• Check this DeFi lending protocol for oracle price manipulation through flash loans.
• Look at our cross-chain bridge's signature verification for threshold bypass or replay risks.
• Assess whether our exposed RPC endpoint on port 8545 accepts unauthenticated transactions.

Safety notes on scripts and network access

The skill runs no scripts of its own, but it does use the network, because the Etherscan lookup calls an external API. Only use it on contracts and infrastructure you own or have written permission to test. The content is attack-oriented, and misuse could cause real financial loss.

Treat the agent's findings as leads to verify. The checklist is a short list of keywords and techniques, not a complete audit, so it will not replace a professional review before deployment.

Tips for better results

The skill's own text is mostly in Chinese, with English tool names and technical terms, so English requests still match the same topics. Give the agent the exact contract source or its verified address, and say which Solidity version it uses, since the checklist treats versions below 0.8 differently for overflow risk.

Ask the agent to name which checklist item each finding relates to. That makes it easier to check the result with Slither or Mythril output.