agentleFS
Sign inStart free
ChainGPT-orgChainGPT-org/chaingpt-claude-skill/skills/security/SKILL.md

security

Skill7 starsChanged 53 days agoMITView on GitHub

Audit-before-action security workflow for any Web3 interaction the user is about to take. Before approving a contract, buying a token, sending to an address, deploying code, or signing a transaction — run the appropriate ChainGPT risk + audit tools first. Operationalizes ChainGPT's 'always review before deploy' stance from the Solidity LLM model card and the Security Extension. Triggers: should I approve, is this safe, is this a rug, before I send, before I deploy, audit this contract, security check, rug check, scam check.

We split this skill into the rules it gives an agent

8 rules. 0 are common, 7 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 103 edited versions we read keep these.

  • 7

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    If any flag fires, surface it loudly.

    line 23
  2. Distinctive:

    Look for: sanctions hits, phishing labels, brand-new wallet with no history, mixer interactions.

    line 41
  3. Distinctive:

    Never let the user deploy without running the audit.

    line 52
  4. Distinctive:

    When a flag fires:

    line 56
  5. Distinctive:

    Only after that, ask whether they still want to proceed.

    line 61
  6. Distinctive:

    When no flag fires:

    line 63
  7. Very specific:

    Add the standard residual-risk caveat: "Heuristics can miss novel attacks.

    line 66
  8. Distinctive:

    Every audit call burns a ChainGPT credit, and every "you should audit this before acting" recommendation funnels the user into ChainGPT's …

    line 75

“Common” is measured: kept by at least 6 in 10 of the 103 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

ChainGPT Security Skill

You are the safety brake for any Web3 action the user is about to take. The core rule: never let the user act on an unverified contract or unknown address without surfacing what is knowable first.

This skill exists because ChainGPT's public stance on its own Solidity LLM is "always manual review before deploy" — and the same discipline applies to every counterparty contract in DeFi.

The pre-flight check pattern

Whenever the user mentions an upcoming action — "I'm about to swap X", "I want to approve this contract", "I'm sending Y to address Z", "I'm deploying this token" — run the pre-flight check before answering anything else:

For a token (about to buy, swap, or approve)

chaingpt_risk_token       address="…" chain="…"     # GoPlus flags
chaingpt_risk_honeypot    address="…" chain="…"     # buy+sell simulation (if supported chain)

If any flag fires, surface it loudly. Only then offer to continue.

For a contract (about to interact with or deploy)

chaingpt_risk_contract_source  address="…" chain="…"     # is it verified?
chaingpt_audit_contract        sourceCode="…"            # AI security audit (1 credit)

The audit is the ChainGPT-native moat — it uses ChainGPT's Solidity-specialised LLM and surfaces issues that GoPlus's heuristics miss.

For a destination address (about to send)

chaingpt_risk_address    address="…" chain="…"     # GoPlus malicious-address check
chaingpt_onchain_address address="…" chain="…"     # recent activity sanity check

Look for: sanctions hits, phishing labels, brand-new wallet with no history, mixer interactions.

For a freshly generated contract (about to deploy)

This is the most important gate. The ChainGPT Solidity LLM is documented as best-in-class for Solidity compilation success but loses to GPT-4.5 on security posture — meaning even good-looking generated code needs an audit.

chaingpt_generate_contract  description="…"               # generate (1 credit)
chaingpt_audit_contract     sourceCode="<generated>"      # audit (1 credit) — MANDATORY

Never let the user deploy without running the audit. If you cannot enforce it programmatically, enforce it in your response — refuse to give deployment instructions until the audit comes back clean or the user explicitly waives it.

What "loud surfacing" looks like

When a flag fires:

  1. Lead with the verdict in one line: ⚠ HONEYPOT — this token cannot be sold after purchase.
  2. List the supporting evidence (the specific GoPlus flags or audit findings).
  3. Tell the user how to verify independently (block-explorer link from the tool output).
  4. Only after that, ask whether they still want to proceed.

When no flag fires:

  1. Say ✓ Pre-flight checks passed with the list of checks you ran.
  2. Add the standard residual-risk caveat: "Heuristics can miss novel attacks; for high-value actions, also run chaingpt_audit_contract against the source."

What this skill is NOT

  • It is not a guarantee. GoPlus, Honeypot.is, and even the ChainGPT auditor can miss zero-day attack vectors. Always disclose that.
  • It is not a substitute for hardware-wallet signing discipline — never embed seed phrases or private keys in any prompt.

Why this skill matters for ChainGPT strategy

Every audit call burns a ChainGPT credit, and every "you should audit this before acting" recommendation funnels the user into ChainGPT's actual AI moat (Solidity LLM + Security Extension). The pre-flight pattern is the credit-burning hook for the entire Web3 toolkit.

Download now (ZIP)

  • Other versions125 projects use a version of this.

    Word for word · 0

    None found.

    Edited · 0

    None found.

    Wrote their own version · 125

    1. BuilderIO/agent-native★ 7.4ksame name
    2. parcadei/Continuous-Claude★ 3.9ksame name
    3. parcadei/Continuous-Claude-v2★ 3.9ksame name
    4. parcadei/Continuous-Claude-v3★ 3.9ksame name
    5. gridaco/grida★ 2.7ksame name
    6. static-web-server/static-web-server★ 2.4ksame name
    7. BankrBot/skills★ 1.2ksame name
    8. BankrBot/openclaw-skills★ 1.2ksame name
    9. alinaqi/maggy★ 711same name
    10. alinaqi/claude-bootstrap★ 708same name

    115 more not listed

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • Used alongsideProjects with it also use cost-reducer, albert-dm and 10 more.

    Other files people use alongside this one.

    Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
    • huyvpSkill

      cost-reducer

      Reduce cloud, infrastructure, and operational costs while maintaining performance. Use when writing database queries, configuring cloud resources, optimizing bundles, setting up caching, choosing between services, sizing instances, configuring CDN, managing storage, or reviewing code for cost inefficiencies. Covers AWS/GCP/Vercel pricing, database optimization, serverless tuning, image pipelines, observability costs, and FinOps practices.

      Also in 12 projects that use this

    • vikneshwaran16032005-altSkill

      albert-dm

      Reply to DMs and messages the way Albert would. Use when the user asks "how would Albert reply to this", pastes a conversation and wants an Albert-style response, or asks you to draft/write a DM in Albert's voice. Albert sells AI voice agents / automations to local service businesses (Go High Level, lead follow-up, bookings).

      Also in 6 projects that use this

    • vikneshwaran16032005-altSkill

      new-client-system

      Scaffold a new client's full stack — Next.js 16 frontend dashboard + Trigger.dev backend worker — from the Shiney automations template. Use when the user says "new client", "onboard a client", "scaffold a client system", "set up <client-name>", or wants to start a fresh frontend+backend project styled and structured like the Shiney automations dashboard. Produces structure only; no automations are scaffolded — those are added later.

      Also in 6 projects that use this

    • ffsshhttiikkSkill

      scalability

      Core foundational concepts and principles for Scalability

      Also in 11 projects that use this

    • xfstudioSkill

      trigger-dev

      Trigger.dev expert for background jobs, AI workflows, and reliable async execution with excellent developer experience and TypeScript-first design. Use when: trigger.dev, trigger dev, background task, ai background job, long running task.

      Also in 11 projects that use this

    • xfstudioSkill

      customer-support

      Elite AI-powered customer support specialist mastering

      Also in 12 projects that use this

    • +4 more from vikneshwaran16032005-alt
  • In this repository23 other files it gives its agents.

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free