classify-onchain-owner
Skill76 starsChanged 20 days agoApache-2.0View on GitHub
These are the raw probes for determining what an owner address IS on chain. A caller runs the relevant probe, interprets the result per the tables below, then applies its OWN policy (reject EOA, ask-the-user for non-Safe, existence-only sanity check, controller classification, etc.). This skill supplies the primitives and their interpretation only — it does not decide policy. cast code <address> --rpc-url <rpc> (or the multiProvider equivalent): cast call <address> "VERSION()(string)" --rpc-url <rpc>: Derive the deterministic ICA address for (origin,…
Files
Classify On-Chain Owner (primitive probes)
These are the raw probes for determining what an owner address IS on chain. A caller runs the relevant probe, interprets the result per the tables below, then applies its OWN policy (reject EOA, ask-the-user for non-Safe, existence-only sanity check, controller classification, etc.). This skill supplies the primitives and their interpretation only — it does not decide policy.
EVM / Tron — code probe (EOA vs EIP-7702 vs contract)
cast code <address> --rpc-url <rpc> (or the multiProvider equivalent):
| Result | Meaning |
0x (no code) | Plain EOA. |
0xef0100<20-byte-delegate> — 46 chars, matches ^0xef0100[0-9a-fA-F]{40}$ | EIP-7702-delegated EOA. Still has a private key behind it; treat as an EOA for ownership purposes. |
| any other bytecode | Contract (Safe / ICA / timelock / custom multisig / …) — probe further. |
EVM — Safe probe
cast call <address> "VERSION()(string)" --rpc-url <rpc>:
| Result | Meaning |
a version string (e.g. "1.3.0") | Gnosis Safe — record the version. |
| reverts / no return | Not a Safe — some other contract; probe further or ask the user. |
EVM — ICA derivation
Derive the deterministic ICA address for (origin, controlling-owner) read-only — view calls only, no transaction — with get-owner-ica.ts and NO --deploy:
pnpm --silent tsx typescript/infra/scripts/keys/get-owner-ica.ts \
--environment mainnet3 --ownerChain <origin> --owner <controlling-owner> --chains <chain>⚠️ Never use
hyperlane ica deployfor this probe. That CLI command has no read-only mode: it deploys the ICA (spends gas, creates a contract) whenever the derived account is absent. Probing a non-ICA owner therefore mints an unrelated ICA — the exact failure a read-only classifier must avoid.get-owner-ica.tswithout--deployonly callsInterchainAccount.getAccount(a view) and prints the address.
Compare the derived address to the on-chain owner:
| Result | Meaning |
| derived address == the on-chain owner | The owner is an ICA controlled by <controlling-owner> on <origin>. Classify the controller by re-running the code + Safe probes on it. |
| derived address != the owner | Not an ICA from that origin/controller — try another origin/controller, or ask the user. |
Sealevel — account existence
getAccountInfo(<pubkey>) via the SVM SDK provider:
| Result | Meaning |
| null | Address has never had state on this chain (transferring ownership here would brick the route). |
| non-null | Account exists (may be executable / PDA / plain wallet). |
Open-set note
Contract-but-not-a-Safe is NOT automatically an ICA. These probes cover only the cheap cases (EOA via code, Safe via VERSION(), ICA via a known origin/controller derivation). Everything else — Squads multisig PDA, Turnkey, Privy, MPC, custom multisig, timelock — the caller must resolve with the user; never guess.
Consumers
/warp-deploy-validate-owners (per-chain classify + reject-EOA policy), /warp-update-resolve-artifacts (per-artifact classify + governance-map shortcut + open-set + controller classification), /warp-deploy-update-owners (target-owner existence sanity check).
In this repository49 other files it gives its agents.
- AGENTS.mdAGENTS.md
- add-registry-changesetSkill
- build-docker-imageSkill
- code-reviewSkill
- debug-messageSkill
- debug-rpc-providerSkill
- debug-validator-checkpoint-inconsistencySkill
- denylist-stuck-messagesSkill
- fetch-linear-ticketSkill
- fetch-safe-tx-batchSkill
- find-docker-imageSkill
- fix-merkle-root-mismatchSkill
- fix-rpc-urlsSkill
- gcp-logsSkill
- hyperlane-message-utilsSkill
- hyperlane-utilsSkill
- inline-pr-commentsSkill
- investigate-merkle-root-mismatchSkill
- investigate-stuck-messagesSkill
- registry-yaml-sort-policySkill
- security-reviewSkill
- self-relay-hyperlane-messageSkill
- set-moonpay-standing-quotesSkill
- start-http-registrySkill
- stop-http-registrySkill
- svm-warp-alt-manageSkill
- svm-warp-program-upgradeSkill
- tob-reviewSkill
- verify-warp-contractsSkill
- warp-balancesSkill
- warp-deploy-fund-deployerSkill
- warp-deploy-init-routeSkill
- warp-deploy-nexusSkill
- warp-deploy-register-routeSkill
- warp-deploy-select-keysSkill
- warp-deploy-send-testSkill
- warp-deploy-update-ownersSkill
- warp-deploy-validate-ownersSkill
- warp-forkSkill
- warp-key-value-expansionSkill
- warp-manage-offchain-quotesSkill
- warp-route-checkSkill
- warp-run-logSkill
- warp-simulate-svm-txsSkill
- warp-update-extendSkill
- warp-update-proposeSkill
- warp-update-resolve-artifactsSkill
- warp-updateSkill
- warp-verify-onchain-configSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.