Project overview and audit preparation for smart contract security. Triggers on weasel overview, weasel scope, or weasel onboard.
/plugin marketplace add slvDev/weasel/plugin install weasel@weaselThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Project overview and audit scoping for security engineers starting a new audit.
User Functions (highest risk - untrusted input):
Admin Functions (check access control):
Callbacks (reentrancy risk):
Untrusted - assume malicious:
Privileged - trusted but verify:
Internal - trusted:
| Project Type | High-Risk Areas |
|---|---|
| DeFi/Lending | Liquidation, interest calc, oracles, flash loans |
| DEX/AMM | Price calc, slippage, LP math, fees |
| Staking/Vaults | Deposit/withdraw, rewards, share accounting |
| NFT/Gaming | Minting, randomness, marketplace |
| Governance | Voting, timelock, proposal execution |
# [Project Name] Overview
## Summary
[2-3 sentences: what does this project do?]
## Architecture
- Contract list with purpose
- Key inheritance (ERC4626, Ownable, etc.)
- External dependencies
## Entry Points
### User Functions (Priority: High)
| Function | Contract | Risk |
|----------|----------|------|
| deposit() | Vault.sol:45 | Handles ETH |
| withdraw() | Vault.sol:89 | Sends ETH |
### Admin Functions (Check Access Control)
| Function | Contract | Permission |
|----------|----------|------------|
| setFee() | Vault.sol:120 | onlyOwner |
### Callbacks (Reentrancy Risk)
- onFlashLoan() called by flash lender
## Value Flow
- **In:** ETH via deposit(), tokens via depositToken()
- **Out:** ETH via withdraw(), rewards via claim()
## Trust Model
- **Owner:** Can pause, set fees (max X%)
- **External:** Chainlink oracle (single price feed)
## Audit Focus (Prioritized)
1. [High] Reentrancy in withdraw() - external call before state update
2. [High] Oracle manipulation - single feed, no TWAP
3. [Med] Share inflation - first depositor attack?
## Recommended Audit Order
1. Vault.sol - core logic, highest risk
2. Router.sol - entry point, input validation
3. Token.sol - standard ERC20, lower priority
Offer:
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.