Agent skill

Contract Key Safety

Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace

MITAuto-check passed

Install Contract Key Safety

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .claude/skills/contract-key-safety && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .claude/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .agents/skills/contract-key-safety && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .agents/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .cursor/skills/contract-key-safety && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .cursor/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/PlamenTSV/plamen.git --path agents/skills/daml/contract-key-safety

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .gemini/skills/contract-key-safety && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .gemini/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .github/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .github/skills/contract-key-safety && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .github/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill contract-key-safety -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen contract-key-safety --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agents/skills/daml/contract-key-safety .opencode/skills/contract-key-safety && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "contract-key-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/contract-key-safety into .opencode/skills/contract-key-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "contract-key-safety", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: contract-key-safety
GitHub stars: 303
Token cost: ~1.5k tokens
SKILL.md length: 623 words
Files: 1
Skills in repo: 87
Repo updated: Sep 26, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace

Works in 4 steps: Key + Maintainer Inventory → lookupByKey False-None Audit → exerciseByKey / fetchByKey Authority → …
Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents
SKILL.md covers 1. Key + Maintainer Inventory, 2. lookupByKey False-None Audit, 3. exerciseByKey / fetchByKey… and 4. Stale-Key / Cleanup, plus 2 more sections
Needs NO_SUCH_KEY

What it does

Contract Key Safety is an agent skill from PlamenTSV/plamen. Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

The repository describes itself as: Autonomous Web3 security audit agent for Claude Code. The licence is MIT.

When your agent uses it

Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents
Depth-state-trace

Example prompts

“/contract-key-safety”

Requirements

A credential in NO_SUCH_KEY

Workflow steps

4 steps, taken from the step headings in SKILL.md.

Key + Maintainer Inventory
lookupByKey False-None Audit
exerciseByKey / fetchByKey Authority
Stale-Key / Cleanup

What it can do on your machine

Read from SKILL.md and the folder at commit 795962b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- NO_SUCH_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Contract Key Safety loads about 1.5k tokens when it runs. Until then it costs about 39 tokens; SKILL.md has 623 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~39
When it runs · the whole SKILL.md, loaded when a task matches: ~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from PlamenTSV/plamen at commit 795962b, republished under its MIT licence (© PlamenTSV). 623 words, ~1,521 tokens.

Download SKILL.mdSave it as .claude/skills/contract-key-safety/SKILL.md (or your agent's skills folder).

name: contract-key-safety
description: Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace

CONTRACT_KEY_SAFETY Skill (DAML)

Trigger Pattern: Always required for DAML audits — self-skip if no template defines a key Inject Into: Breadth agents, depth-state-trace Finding prefix: [DML-CK-N] Rules referenced: R8, R12

A DAML contract key is a uniqueness handle plus a maintainer set. The single most dangerous DAML key bug is the lookupByKey false-None: a None result means "no contract with this key is visible to the reading parties" — NOT "no such contract exists". A choice that treats None as "absent" and creates fresh state can mint duplicates. Additionally, maintainer parties MUST be signatories of the keyed contract; a maintainer/signatory gap breaks key authority. If no template in scope defines a key, this skill self-skips (every section ✗(N/A — no keyed templates)).

1. Key + Maintainer Inventory

For every template that defines a key:

Template	Key Type/Expr	Maintainer Expr	Maintainers ⊆ Signatories?	Key Globally Unique?	Finding?
`{T}`	`key (owner, id) : (Party, Text)`	`maintainer key._1`	YES/NO	YES/NO	`[DML-CK-N]` if maintainer not signatory

Critical patterns to flag:

A maintainer party that is NOT in the template's signatory set — DAML requires maintainers be signatories; if the code attempts otherwise it will not compile, but a refactor that drops a signatory while keeping the maintainer is a latent break. Verify the binding holds.
A key whose maintainer set is a single party where the keyed value represents joint state (one party can unilaterally re-key).

DAML note: A negative lookupByKey (the None branch) requires the maintainers' authority to assert non-existence. If the reading party is not a maintainer, they cannot get an authoritative None.

2. lookupByKey False-None Audit

For every lookupByKey/visibleByKey call, determine what the None branch does and whether None is correctly interpreted:

Choice	lookupByKey Target	None Branch Action	Reader Is Maintainer?	False-None Risk?
`{T.C}`	`{key}`	creates fresh / treats as absent / errors	YES/NO	`[DML-CK-N]` if None→create and reader not maintainer

Attack: A choice does lookupByKey @T k and, on None, creates a new T. If the exercising party is not a maintainer of T, None only means "not visible to me" — a contract with key k may already exist, signed by other parties. The caller mints a duplicate, breaking the uniqueness invariant ([ELEVATE:LOOKUP_FALSE_NONE]).

Check for:

None-branch creates that are reachable by a party who is not a maintainer of the looked-up key.
None-branch that grants access / resets a counter / re-initializes config assuming the key was never set.

Show full SKILL.md (235 more words)Show less

3. exerciseByKey / fetchByKey Authority

exerciseByKey/fetchByKey require the maintainers' authority to resolve the key. Verify the exercising context actually has it:

Choice	Uses exerciseByKey/fetchByKey?	Target Key	Maintainer Authority Present In Context?	Finding?
`{T.C}`	YES/NO	`{key}`	YES/NO	`[DML-CK-N]` if authority gap

Check for:

A choice that exerciseByKeyes a contract whose maintainers are not authorizers of the current transaction — it will fail at runtime (liveness brick) OR, if the maintainer happens to be a controller, may resolve a contract the caller should not reach.
Authority assumed via the one-hop propagation rule that does not actually hold for the keyed target.

4. Stale-Key / Cleanup

A keyed contract that is archived without its key being freed (or recreated under a stale value) leaves dangling-key risk.

Template	Archived By	Key Freed / Recreated Correctly?	Stale-Key Reachable?	Finding?
`{T}`	`{choice}`	YES/NO	YES/NO	`[DML-CK-N]` if stale

Check for:

A lifecycle where the keyed contract is archived but a consumer still exerciseByKeys the old key → NO_SUCH_KEY brick.
A re-create that reuses an old key with stale field values, so a lookupByKey returns outdated state a later choice trusts.

Finding Template

markdown

**ID**: [DML-CK-N]
**Severity**: [Critical if duplicate mint / uniqueness break, High if liveness brick, Medium if stale read]
**Step Execution**: ✓1,2,3,4 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [R8:✓/✗, R12:✓/✗]
**Location**: {Module}.daml:LineN (template X, choice Y)
**Title**: lookupByKey false-None / maintainer-authority gap in {Choice} allows {duplicate / brick / stale read}
**Description**: [The key, the None-branch action or maintainer gap, and why the reader's visibility ≠ existence]
**Impact**: [Duplicate keyed contract minted / uniqueness invariant broken / choice bricks / stale state trusted]
**PoC steer**: allocate a party that genuinely cannot see the keyed contract (not a maintainer/stakeholder), exercise the None-branch, assert a duplicate exists via a maintainer's `query@T`.

Step Execution Checklist (MANDATORY)

Section	Required	Completed?	Notes
1. Key + Maintainer Inventory	IF keyed templates present	✓/✗(N/A)/?	Every template with a `key`
2. lookupByKey False-None Audit	IF lookupByKey used	✓/✗(N/A)/?	Every None branch
3. exerciseByKey / fetchByKey Authority	IF exerciseByKey/fetchByKey used	✓/✗(N/A)/?	Maintainer authority in context
4. Stale-Key / Cleanup	IF keyed templates archived	✓/✗(N/A)/?	Archive-then-lookup lifecycles

Files

Just SKILL.md in agents/skills/daml/contract-key-safety of PlamenTSV/plamen.

Open the folder on GitHubat commit 795962b

Compare with similar skills

Contract Key Safety next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Contract Key Safety compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Contract Key Safety this skillPlamenTSV/plamen	303	—	~1.5k	Automated safety check: Pass	MIT	13 days ago
Audit Exception Safetyben-manes/caffeine	18k	—	~633	Automated safety check: Pass	Apache-2.0	yesterday
Python Patternsaffaan-m/ECC	276k	—	~2.3k	Automated safety check: Pass	MIT	today
React Audit Grep Patternsgithub/awesome-copilot	40k	1 repos	~461	Automated safety check: Pass	MIT	yesterday
Audit Subsystem Safetyben-manes/caffeine	18k	—	~697	Automated safety check: Pass	Apache-2.0	yesterday
Memory Safety Patternswshobson/agents	40k	9 repos	~646	Automated safety check: Pass	MIT	5 days ago

Similar skills

Audit Exception Safety
ben-manes/caffeine
Audit exception safety and failure atomicity across all throw sites
18k GitHub stars~633 tokensUpdated yesterday
Auto-check passed
Python Patterns
affaan-m/ECC
Python-specific design patterns and best practices including protocols, dataclasses, context managers, decorators, async/await, type hints, and package organization.
276k GitHub stars~2.3k tokensUpdated today
DevelopmentAuto-check passed
React Audit Grep Patterns
github/awesome-copilot
Official
Provides the complete, verified grep scan command library for auditing React codebases before a React 18.3.1 or React 19 upgrade.
40k GitHub starsUsed in 1 repo~461 tokens
Auto-check passed
Audit Subsystem Safety
ben-manes/caffeine
Audit one cache subsystem for concurrency correctness defects
18k GitHub stars~697 tokensUpdated yesterday
Auto-check passed
Memory Safety Patterns
wshobson/agents
Implement memory-safe programming with RAII, ownership, smart pointers, and resource management across Rust, C++, and C.
40k GitHub starsUsed in 9 repos~646 tokens
Auto-check passed
Golang Patterns
affaan-m/ECC
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization.
276k GitHub stars~1.1k tokensUpdated today
DevelopmentAuto-check passed

Questions about Contract Key Safety

What does Contract Key Safety do?

Trigger Pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents, depth-state-trace. Contract Key Safety is an agent skill from PlamenTSV/plamen.

When should I use Contract Key Safety?

Contract Key Safety fits situations like: pattern Always required for DAML audits (self-skips if no template defines a key) - Inject Into Breadth agents; depth-state-trace.

How do I install Contract Key Safety in Claude Code?

Run `npx skills add PlamenTSV/plamen --skill contract-key-safety -a claude-code`. Or copy the skill folder (agents/skills/daml/contract-key-safety in PlamenTSV/plamen) into .claude/skills/contract-key-safety in your project. Claude Code loads it when a task matches its description.

How do I install Contract Key Safety in Codex?

Run `npx skills add PlamenTSV/plamen --skill contract-key-safety -a codex`. Or copy the skill folder (agents/skills/daml/contract-key-safety in PlamenTSV/plamen) into .agents/skills/contract-key-safety in your project. Codex loads it when a task matches its description.

Can I use Contract Key Safety in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PlamenTSV/plamen --skill contract-key-safety -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/contract-key-safety, .gemini/skills/contract-key-safety, .github/skills/contract-key-safety and .opencode/skills/contract-key-safety in your project.

What does Contract Key Safety need to run?

Going by SKILL.md and its folder, Contract Key Safety needs credentials named NO_SUCH_KEY. Our summary lists: A credential in NO_SUCH_KEY.

Does Contract Key Safety access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Contract Key Safety safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Contract Key Safety use?

Contract Key Safety is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Contract Key Safety use?

About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Contract Key Safety?

Skills that share tags, products or a category with Contract Key Safety: Audit Exception Safety (ben-manes/caffeine, 18k stars), Python Patterns (affaan-m/ECC, 276k stars), React Audit Grep Patterns (github/awesome-copilot, 40k stars) and Audit Subsystem Safety (ben-manes/caffeine, 18k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Contract Key Safety?

PlamenTSV (a GitHub user) maintains it in PlamenTSV/plamen, which has 303 GitHub stars. The repository holds 87 skills in this directory. The repository was last updated on September 26, 2026.

Source: PlamenTSV/plamen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Contract Key Safety

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

CONTRACT_KEY_SAFETY Skill (DAML)

1. Key + Maintainer Inventory

2. lookupByKey False-None Audit

3. exerciseByKey / fetchByKey Authority

4. Stale-Key / Cleanup

Finding Template

Step Execution Checklist (MANDATORY)

Files

Compare with similar skills

Similar skills

More from PlamenTSV/plamen

Questions about Contract Key Safety