Agent skill

Defi Amm Security

Solidity AMM 合约、流动性池和交换流程的安全检查清单。涵盖重入、CEI 排序、捐赠或通胀攻击、预言机操纵、滑点、管理员控制和整数数学。

MITAuto-check passedBusiness, Finance & HR

Install Defi Amm Security

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .claude/skills/defi-amm-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .claude/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .agents/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .agents/skills/defi-amm-security && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .agents/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .cursor/skills/defi-amm-security && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .cursor/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/affaan-m/ECC.git --path docs/zh-CN/skills/defi-amm-security

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .gemini/skills/defi-amm-security && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .gemini/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .github/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .github/skills/defi-amm-security && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .github/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add affaan-m/ECC --skill defi-amm-security -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC defi-amm-security --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/docs/zh-CN/skills/defi-amm-security .opencode/skills/defi-amm-security && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "defi-amm-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/zh-CN/skills/defi-amm-security into .opencode/skills/defi-amm-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defi-amm-security", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: defi-amm-security
GitHub stars: 276k
Token cost: ~929 tokens
SKILL.md length: 79 words
Files: 1
Skills in repo: 683
Repo updated: Oct 10, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Solidity AMM 合约、流动性池和交换流程的安全检查清单。涵盖重入、CEI 排序、捐赠或通胀攻击、预言机操纵、滑点、管理员控制和整数数学。

Tasks that involve Crypto and DeFi analysis
SKILL.md covers 适用场景, 工作原理, 执行安全 and 示例, plus 2 more sections
Calls pip
Tasks that involve Smart contracts

What it does

Defi Amm Security is an agent skill from affaan-m/ECC. Solidity AMM 合约、流动性池和交换流程的安全检查清单。涵盖重入、CEI 排序、捐赠或通胀攻击、预言机操纵、滑点、管理员控制和整数数学。

Its SKILL.md is about 930 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Business, Finance & HR, covering Crypto and DeFi analysis and Smart contracts. It works with Solidity. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.

When your agent uses it

Tasks that involve Crypto and DeFi analysis
Tasks that involve Smart contracts

Example prompts

“/defi-amm-security”

Requirements

Python 3

What it can do on your machine

Read from SKILL.md and the folder at commit 4eb71d9. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- pip
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use pip, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Defi Amm Security loads about 929 tokens when it runs. Until then it costs about 23 tokens; SKILL.md has 79 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~23
When it runs · the whole SKILL.md, loaded when a task matches: ~929

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from affaan-m/ECC at commit 4eb71d9, republished under its MIT licence (© affaan-m). 79 words, ~929 tokens.

Download SKILL.mdSave it as .claude/skills/defi-amm-security/SKILL.md (or your agent's skills folder).

name: defi-amm-security
description: Solidity AMM 合约、流动性池和交换流程的安全检查清单。涵盖重入、CEI 排序、捐赠或通胀攻击、预言机操纵、滑点、管理员控制和整数数学。
origin: ECC direct-port adaptation
version: 1.0.0

DeFi AMM 安全

Solidity AMM 合约、LP 金库和交换函数的关键漏洞模式及强化实现。

适用场景

编写或审计 Solidity AMM 或流动性池合约
实现持有代币余额的交换、存款、提款、铸造或销毁流程
审查任何在份额或储备金计算中使用 token.balanceOf(address(this)) 的合约
向 DeFi 协议添加费用设置器、暂停器、预言机更新或其他管理功能

工作原理

将其作为检查清单加模式库使用。对照以下类别审查每个用户入口点，并优先使用强化示例而非自行编写的变体。

执行安全

本技能中的 shell 命令是本地审计示例。仅在受信任的代码检出或一次性沙箱中运行，不要将不受信任的合约名称、路径、RPC URL、私钥或用户提供的标志拼接到 shell 命令中。在安装工具或运行可能消耗大量本地或付费资源的长时间模糊测试/静态分析任务前，请先询问。

切勿在命令示例、日志或报告中包含机密信息、私钥、助记词、API 令牌或主网签名凭证。

示例

重入攻击：强制遵循 CEI 顺序

存在漏洞：

solidity

function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount);
    token.transfer(msg.sender, amount);
    balances[msg.sender] -= amount;
}

安全：

solidity

import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

using SafeERC20 for IERC20;

function withdraw(uint256 amount) external nonReentrant {
    require(balances[msg.sender] >= amount, "Insufficient");
    balances[msg.sender] -= amount;
    token.safeTransfer(msg.sender, amount);
}

当存在经过验证的库时，不要自行编写防护措施。

捐赠或通胀攻击

直接使用 token.balanceOf(address(this)) 进行份额计算，会让攻击者通过向合约发送代币（绕过预期路径）来操纵分母。

solidity

// Vulnerable
function deposit(uint256 assets) external returns (uint256 shares) {
    shares = (assets * totalShares) / token.balanceOf(address(this));
}

solidity

// Safe
uint256 private _totalAssets;

function deposit(uint256 assets) external nonReentrant returns (uint256 shares) {
    uint256 balBefore = token.balanceOf(address(this));
    token.safeTransferFrom(msg.sender, address(this), assets);
    uint256 received = token.balanceOf(address(this)) - balBefore;

    shares = totalShares == 0 ? received : (received * totalShares) / _totalAssets;
    _totalAssets += received;
    totalShares += shares;
}

跟踪内部会计并衡量实际收到的代币。

预言机操纵

现货价格可通过闪电贷操纵。优先使用 TWAP。

solidity

uint32[] memory secondsAgos = new uint32[](2);
secondsAgos[0] = 1800;
secondsAgos[1] = 0;
(int56[] memory tickCumulatives,) = IUniswapV3Pool(pool).observe(secondsAgos);
int24 twapTick = int24(
    (tickCumulatives[1] - tickCumulatives[0]) / int56(uint56(30 minutes))
);
uint160 sqrtPriceX96 = TickMath.getSqrtRatioAtTick(twapTick);

滑点保护

每个交换路径都需要调用者提供的滑点和截止时间。

solidity

function swap(
    uint256 amountIn,
    uint256 amountOutMin,
    uint256 deadline
) external returns (uint256 amountOut) {
    require(block.timestamp <= deadline, "Expired");
    amountOut = _calculateOut(amountIn);
    require(amountOut >= amountOutMin, "Slippage exceeded");
    _executeSwap(amountIn, amountOut);
}

安全的储备金计算

solidity

import {FullMath} from "@uniswap/v3-core/contracts/libraries/FullMath.sol";

uint256 result = FullMath.mulDiv(a, b, c);

对于大型储备金计算，当存在溢出风险时，避免使用简单的 a * b / c。

管理控制

solidity

import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";

contract MyAMM is Ownable2Step {
    function setFee(uint256 fee) external onlyOwner { ... }
    function pause() external onlyOwner { ... }
}

所有权转移应优先使用显式接受，并对每个特权路径设置门控。

安全检查清单

暴露于重入攻击的入口点使用 nonReentrant
遵循 CEI 顺序
份额计算不依赖原始的 balanceOf(address(this))
ERC-20 转账使用 SafeERC20
存款衡量实际收到的代币
预言机读取使用 TWAP 或其他抗操纵源
交换需要 amountOutMin 和 deadline
对溢出敏感的储备金计算使用安全原语，如 mulDiv
管理函数受访问控制
存在紧急暂停功能并经过测试
在生产前运行静态分析和模糊测试

审计工具

bash

pip install slither-analyzer
slither . --exclude-dependencies

echidna-test . --contract YourAMM --config echidna.yaml

forge test --fuzz-runs 10000

Files

Just SKILL.md in docs/zh-CN/skills/defi-amm-security of affaan-m/ECC.

Open the folder on GitHubat commit 4eb71d9

Compare with similar skills

Defi Amm Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Defi Amm Security compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Defi Amm Security this skillaffaan-m/ECC	276k	—	~929	Automated safety check: Pass	MIT	yesterday
Okx Cex Earnokx/agent-skills	187	2 repos	~3.3k	Automated safety check: Pass	MIT	18 days ago
Web3 Testingwshobson/agents	40k	12 repos	~2k	Automated safety check: Pass	MIT	6 days ago
DeFi Protocol Templateswshobson/agents	40k	11 repos	~1.9k	Automated safety check: Pass	MIT	6 days ago
Onchain Pay Open APInpc-live/clawfirm	156	1 repos	~4.9k	Automated safety check: Pass	MIT	3 mo ago
Aptos Explorer Urlsaptos-labs/explorer	124	—	~1.2k	Automated safety check: Pass	None	yesterday

Similar skills

Okx Cex Earn
okx/agent-skills
Manages OKX Simple Earn (flexible savings/lending), Flash Earn, On-chain Earn (staking/DeFi), Dual Investment (DCD/双币赢), and AutoEarn (自动赚币) via the okx CLI.
187 GitHub starsUsed in 2 repos~3.3k tokens
Business, Finance & HRAuto-check passed
Web3 Testing
wshobson/agents
Test smart contracts comprehensively using Hardhat and Foundry with unit tests, integration tests, and mainnet forking.
40k GitHub starsUsed in 12 repos~2k tokens
Testing & QAAuto-check passed
DeFi Protocol Templates
wshobson/agents
Solidity templates for DeFi building blocks: staking with reward distribution, an automated market maker, governance tokens and flash loans.
40k GitHub starsUsed in 11 repos~1.9k tokens
Backend & APIsAuto-check passed
Onchain Pay Open API
npc-live/clawfirm
Binance Onchain Pay enables users to buy cryptocurrency with fiat (e.g., EUR, USD) or send existing crypto from their Binance account directly to any external on-chain wallet address in a single…
156 GitHub starsUsed in 1 repo~4.9k tokens
Business, Finance & HRAuto-check passed
Aptos Explorer Urls
aptos-labs/explorer
Map questions about Aptos blockchain entities (transactions, accounts, blocks, validators, coins, fungible assets, NFTs, Move objects, ANS names) to canonical Aptos Explorer URLs at…
124 GitHub stars~1.2k tokensUpdated yesterday
Business, Finance & HRAuto-check passed
Ethskills
austintgriffith/ethskills
Ethereum development knowledge for AI agents — from idea to deployed dApp.
295 GitHub stars~1.4k tokensUpdated 1 mo ago
Backend & APIsAuto-check passed

Questions about Defi Amm Security

What does Defi Amm Security do?

Solidity AMM 合约、流动性池和交换流程的安全检查清单。涵盖重入、CEI 排序、捐赠或通胀攻击、预言机操纵、滑点、管理员控制和整数数学。. Defi Amm Security is an agent skill from affaan-m/ECC.

When should I use Defi Amm Security?

Defi Amm Security fits situations like: tasks that involve Crypto and DeFi analysis; tasks that involve Smart contracts.

How do I install Defi Amm Security in Claude Code?

Run `npx skills add affaan-m/ECC --skill defi-amm-security -a claude-code`. Or copy the skill folder (docs/zh-CN/skills/defi-amm-security in affaan-m/ECC) into .claude/skills/defi-amm-security in your project. Claude Code loads it when a task matches its description.

How do I install Defi Amm Security in Codex?

Run `npx skills add affaan-m/ECC --skill defi-amm-security -a codex`. Or copy the skill folder (docs/zh-CN/skills/defi-amm-security in affaan-m/ECC) into .agents/skills/defi-amm-security in your project. Codex loads it when a task matches its description.

Can I use Defi Amm Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill defi-amm-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defi-amm-security, .gemini/skills/defi-amm-security, .github/skills/defi-amm-security and .opencode/skills/defi-amm-security in your project.

What does Defi Amm Security need to run?

Going by SKILL.md and its folder, Defi Amm Security needs the command-line tools its instructions call (pip). Our summary lists: Python 3.

Does Defi Amm Security access the network?

SKILL.md contains no URLs. Its commands use pip, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Defi Amm Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Defi Amm Security use?

Defi Amm Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Defi Amm Security use?

About 929 tokens (SKILL.md is roughly 3.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Defi Amm Security?

Skills that share tags, products or a category with Defi Amm Security: Okx Cex Earn (okx/agent-skills, 187 stars), Web3 Testing (wshobson/agents, 40k stars), DeFi Protocol Templates (wshobson/agents, 40k stars) and Onchain Pay Open API (npc-live/clawfirm, 156 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Defi Amm Security?

affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 276,111 GitHub stars. The repository holds 683 skills in this directory. The repository was last updated on October 10, 2026.

Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Defi Amm Security

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

DeFi AMM 安全

适用场景

工作原理

执行安全

示例

重入攻击：强制遵循 CEI 顺序

捐赠或通胀攻击

预言机操纵

滑点保护

安全的储备金计算

管理控制

安全检查清单

审计工具

Files

Compare with similar skills

Similar skills

More from affaan-m/ECC

Related

Questions about Defi Amm Security