Stellar Dev
VelaPayments/vela-payments
End-to-end Stellar development playbook. An agent skill from VelaPayments/vela-payments.
Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case
Install Overflow Safety
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install PlamenTSV/plamen overflow-safety --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .claude/skills/overflow-safety && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .claude/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safetyType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install PlamenTSV/plamen overflow-safety --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .agents/skills/overflow-safety && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .agents/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install PlamenTSV/plamen overflow-safety --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .cursor/skills/overflow-safety && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .cursor/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/PlamenTSV/plamen.git --path agents/skills/soroban/overflow-safety--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install PlamenTSV/plamen overflow-safety --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .gemini/skills/overflow-safety && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .gemini/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install PlamenTSV/plamen overflow-safetyInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .github/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .github/skills/overflow-safety && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .github/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PlamenTSV/plamen --skill overflow-safety -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install PlamenTSV/plamen overflow-safety --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agents/skills/soroban/overflow-safety .opencode/skills/overflow-safety && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "overflow-safety" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/soroban/overflow-safety into .opencode/skills/overflow-safety/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "overflow-safety", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
overflow-safety- GitHub stars
- 303
- Token cost
- ~1.9k tokens
- SKILL.md length
- 725 words
- Files
- 1
- Skills in repo
- 87
- Repo updated
- First seen
- Licence
- MIT
At a glance
Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case
- Works in 5 steps: Profile Check → Arithmetic Trace (if overflow-checks is… → Checked Arithmetic Patterns → …
- Pattern Always required for Soroban audits - Inject Into Breadth agents
- SKILL.md covers 1. Profile Check, 2. Arithmetic Trace (if…, 3. Checked Arithmetic Patterns and 4. i128 Boundary Analysis, plus 3 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Overflow Safety is an agent skill from PlamenTSV/plamen. Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case
Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Smart contract auditing. It works with Stellar and Rust. The repository describes itself as: Autonomous Web3 security audit agent for Claude Code. The licence is MIT.
When your agent uses it
- Pattern Always required for Soroban audits - Inject Into Breadth agents
- Depth-edge-case
Example prompts
- “/overflow-safety”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 795962b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are rust and markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Overflow Safety loads about 1.9k tokens when it runs. Until then it costs about 28 tokens; SKILL.md has 725 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from PlamenTSV/plamen at commit 795962b, republished under its MIT licence (© PlamenTSV). 725 words, ~1,922 tokens.
Download SKILL.mdSave it as
.claude/skills/overflow-safety/SKILL.md (or your agent's skills folder).- name
- overflow-safety
- description
- Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case
OVERFLOW_SAFETY Skill (Soroban)
Trigger Pattern: Always required for Soroban audits Inject Into: Breadth agents, depth-edge-case Finding prefix:
[OF-N]Rules referenced: R10, R14
Soroban contracts are compiled Rust. Rust's overflow behavior depends on the build profile: in debug builds, overflows panic; in release builds (used for deployment), overflows silently wrap by default unless overflow-checks = true is set. Silent wrapping in financial arithmetic is a critical vulnerability.
1. Profile Check
Before tracing any arithmetic, inspect Cargo.toml for the release profile overflow setting:
| File | [profile.release] Present? | overflow-checks Setting | Safe? |
|---|---|---|---|
Cargo.toml | YES/NO | true / false / MISSING | Only if true |
Interpretation:
overflow-checks = true→ all integer arithmetic panics on overflow in release builds. The codebase is safe from silent wrapping.overflow-checks = falseor missing → overflows silently wrap in release. Proceed to Section 2.- If the file does not exist or does not contain
[profile.release]: treat asfalse(Rust default for release).
Finding threshold: If overflow-checks is not true, the entire overflow safety of the contract depends on manual use of checked/saturating arithmetic. This is a configuration-level finding regardless of whether Section 2 finds specific overflow sites.
2. Arithmetic Trace (if overflow-checks is false/missing)
If the profile check from Section 1 found that overflow protection is NOT enabled, trace ALL arithmetic operations in financial paths:
| Location | Expression | Operand Types | Max Realistic Value | Overflow Possible? | Impact if Wrapped |
|---|---|---|---|---|---|
{file:line} | {a + b} | u64 / i128 / u32 | {estimate} | YES/NO | {balance wraps to 0, share inflates, etc.} |
Financial paths to prioritize:
- Token balance calculations (
balance + amount,total_supply + mint_amount) - Share/ratio calculations (
shares * price / precision) - Fee calculations (
amount * fee_bps / 10000) - Interest accrual (
principal * rate * time) - Reward distributions (
rewards_per_token * user_balance)
Wrapping arithmetic consequences:
u128overflows near2^128 ≈ 3.4 × 10^38— practically unreachable for balancesi128overflows near2^127 ≈ 1.7 × 10^38— practically unreachable for balancesu64overflows near1.8 × 10^19— reachable with large token amounts in 6-decimal tokensu32overflows near4.3 × 10^9— reachable in ledger numbers, timestamps, counts
3. Checked Arithmetic Patterns
Identify all financial arithmetic and classify whether safe arithmetic methods are used:
| Location | Operation | Method Used | Safe? |
|---|---|---|---|
{file:line} | {description} | + / checked_add / saturating_add / wrapping_add | Only checked_* or saturating_* |
Safe methods:
checked_add(b)→ returnsOption<T>, panics or propagates None on overflowchecked_mul(b)→ returnsOption<T>saturating_add(b)→ clamps at MAX (safe for balances where MAX means "very rich")checked_div(b)→ also catches division by zero
Unsafe methods:
+,-,*withoutoverflow-checks = true→ silent wrapping in releasewrapping_add,wrapping_sub,wrapping_mul→ explicitly wraps (intentionally unsafe for most contexts)/→ panics on divide-by-zero regardless of overflow-checks (covered in Section 5)
Flag any unchecked arithmetic where:
- Operands are user-controlled (amounts, durations, counts)
- The result feeds into a balance, share count, or reward calculation
Show full SKILL.md (301 more words)Show less
4. i128 Boundary Analysis
Soroban's native token and SEP-41 tokens frequently use i128 for amounts. Check operations near the boundaries:
| Location | Operation | Uses i128? | Near-Boundary Risk | Checked? |
|---|---|---|---|---|
{file:line} | {expression} | YES/NO | YES/NO | YES/NO |
Specific checks:
- Share calculations:
shares = (amount * total_shares) / total_assets— iftotal_sharesis neari128::MAX, multiplication overflows before division - Cumulative reward trackers:
reward_per_token_stored += rewards * PRECISION / total_supply— accumulation can overflow over time - Negative balance checks:
i128allows negative values; verify contracts reject negative amount parameters via explicitrequire!(amount > 0) - Cast safety:
u128 as i128silently truncates if theu128value exceedsi128::MAX
5. Division Precision
Soroban has no floating-point arithmetic. All division truncates toward zero (integer division). Incorrect division ordering causes precision loss or incorrect results:
| Location | Expression | Division-Before-Multiplication? | Precision Loss Estimate | Impact |
|---|---|---|---|---|
{file:line} | {a / b * c} | YES → FLAG | {up to b-1 units lost} | {financial impact} |
Anti-pattern (division before multiplication):
// BAD: (amount / total_supply) loses precision before multiplying by rewards
let user_share = (user_balance / total_supply) * total_rewards;Correct pattern (multiplication before division):
// GOOD: multiply first to preserve precision
let user_share = (user_balance * total_rewards) / total_supply;Additional checks:
- Division by zero: verify all divisors are checked for zero before use.
require!(total_supply > 0)beforex / total_supply - Rounding direction: does truncation favor the protocol (rounding down on user withdrawals) or systematically favor attackers?
- Precision constants: verify
PRECISION/SCALARconstants match the token decimals being used - Intermediate type precision: if the protocol routes values through a fixed-point intermediate (e.g., FixedI128 with DENOMINATOR=10^N), verify N >= max(token_decimals) for all supported tokens. Double decimal conversion (token A decimals → intermediate → token B decimals) truncates at each step; if the intermediate has fewer precision digits than either token, significant value is silently lost
Finding Template
**ID**: [OF-N]
**Severity**: [Critical if balance wrapping, High if unchecked overflow in financial path, Medium if precision loss, Low if config-only]
**Step Execution**: ✓1,2,3,4,5 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [R10:✓/✗, R14:✓/✗]
**Location**: src/{contract}.rs:LineN (or Cargo.toml for Section 1)
**Title**: {Overflow / Precision loss} in {fn_name} — {impact}
**Description**: [Specific arithmetic expression, operand types, worst-case values, and wrapping consequence]
**Impact**: [Balance wraps to near-zero / share inflation / reward theft / incorrect accounting]Step Execution Checklist (MANDATORY)
| Section | Required | Completed? | Notes |
|---|---|---|---|
| 1. Profile Check | YES | ✓/✗/? | Read Cargo.toml [profile.release] |
| 2. Arithmetic Trace | IF overflow-checks not true | ✓/✗(N/A)/? | All financial paths |
| 3. Checked Arithmetic Patterns | YES | ✓/✗/? | All arithmetic in financial paths |
| 4. i128 Boundary Analysis | YES | ✓/✗/? | Wherever i128 used for amounts/shares |
| 5. Division Precision | YES | ✓/✗/? | All division operations in financial paths |
© PlamenTSV, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in agents/skills/soroban/overflow-safety of PlamenTSV/plamen.
Open the folder on GitHubat commit 795962b
Compare with similar skills
Overflow Safety next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Overflow Safety this skillPlamenTSV/plamen | 303 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Stellar DevVelaPayments/vela-payments | 131 | — | ~1.8k | Automated safety check: Pass | MIT | |
| Web3 Smart Contract Auditawarexone/Agentic-Bug-Hunter | 5.3k | 3 repos | ~4.5k | Automated safety check: Pass | MIT | |
| Solana Vulnerability Scannertrailofbits/skills | 7.4k | — | ~3.6k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Cairo Vulnerability Scannertrailofbits/skills | 7.4k | — | ~3.3k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Soroban Contract Auditsickn33/agentic-awesome-skills | 47k | 1 repos | ~1.4k | Automated safety check: Pass | MIT |
Similar skills
Web3 Smart Contract Audit
awarexone/Agentic-Bug-Hunter
Guides smart contract audits and bounty target selection with ten DeFi bug classes, kill signals, a Foundry PoC template and grep patterns.
- Official
Solana Vulnerability Scanner
trailofbits/skills
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
- Official
Cairo Vulnerability Scanner
trailofbits/skills
Scans Cairo and StarkNet contracts for 6 vulnerability patterns, including felt252 overflow, L1 to L2 messaging faults, address conversion and signature replay.
Soroban Contract Audit
sickn33/agentic-awesome-skills
Soroban smart contract security audit register: authorization checks, panic pathways, integer overflows, and storage footprint verification for Stellar.
Soroban Liquidity Pool
sickn33/agentic-awesome-skills
Automated market maker liquidity pool register: constant-product invariant curves, swap fee tiers, and LP token shares for Soroban DeFi.
More from PlamenTSV/plamen
All 87 skills in this repoAudit Prep
PlamenTSV/plamen
Prepare Solidity projects for a security audit — test coverage, test quality, NatSpec docs, code hygiene, dependency health, best-practice enforcement, deployment readiness, and project…
Verification Protocol
PlamenTSV/plamen
Trigger Pattern Always (used by all verifier agents) - Inject Into security-verifier agents (Phase 5)
Ability Analysis
PlamenTSV/plamen
Trigger Pattern Always (Aptos Move) - foundational security check - Inject Into Breadth agents, depth agents
Ability Analysis
PlamenTSV/plamen
Trigger Pattern Always (Sui Move) -- foundational security check - Inject Into Breadth agents, depth agents
Account Lifecycle
PlamenTSV/plamen
Trigger Pattern ACCOUNTCLOSING flag detected (close/CloseAccount usage) - Inject Into Breadth agents, depth agents
Account Validation
PlamenTSV/plamen
Trigger Pattern Always required for Solana audits - Inject Into Breadth agents, depth agents
Related
Categories
Questions about Overflow Safety
What does Overflow Safety do?
Trigger Pattern Always required for Soroban audits - Inject Into Breadth agents, depth-edge-case. Overflow Safety is an agent skill from PlamenTSV/plamen.
When should I use Overflow Safety?
Overflow Safety fits situations like: pattern Always required for Soroban audits - Inject Into Breadth agents; depth-edge-case.
How do I install Overflow Safety in Claude Code?
Run `npx skills add PlamenTSV/plamen --skill overflow-safety -a claude-code`. Or copy the skill folder (agents/skills/soroban/overflow-safety in PlamenTSV/plamen) into .claude/skills/overflow-safety in your project. Claude Code loads it when a task matches its description.
How do I install Overflow Safety in Codex?
Run `npx skills add PlamenTSV/plamen --skill overflow-safety -a codex`. Or copy the skill folder (agents/skills/soroban/overflow-safety in PlamenTSV/plamen) into .agents/skills/overflow-safety in your project. Codex loads it when a task matches its description.
Can I use Overflow Safety in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PlamenTSV/plamen --skill overflow-safety -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/overflow-safety, .gemini/skills/overflow-safety, .github/skills/overflow-safety and .opencode/skills/overflow-safety in your project.
What does Overflow Safety need to run?
SKILL.md names no scripts, command-line tools or credentials: Overflow Safety is instructions for the agent only.
Does Overflow Safety access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Overflow Safety safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Overflow Safety use?
Overflow Safety is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Overflow Safety use?
About 1.9k tokens (SKILL.md is roughly 7.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Overflow Safety?
Skills that share tags, products or a category with Overflow Safety: Stellar Dev (VelaPayments/vela-payments, 131 stars), Web3 Smart Contract Audit (awarexone/Agentic-Bug-Hunter, 5.3k stars), Solana Vulnerability Scanner (trailofbits/skills, 7.4k stars) and Cairo Vulnerability Scanner (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Overflow Safety?
PlamenTSV (a GitHub user) maintains it in PlamenTSV/plamen, which has 303 GitHub stars. The repository holds 87 skills in this directory. The repository was last updated on September 26, 2026.
Source: PlamenTSV/plamen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.