CtrlK
BlogDocsLog inGet started
Tessl Logo

contracts-bridge-exploit

Cross-chain bridge attack — message-validation bypass (Wormhole class), validator key compromise (Ronin / Harmony class), reentrancy on token-bridge claim, Merkle-proof forgery on optimistic bridges, signature replay across chains. Bridges have lost >$2B; understand why.

68

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, concrete, and actionable with excellent tooling and a specific audit checklist, but it presents a reference catalog rather than a sequenced audit workflow with validation checkpoints, capping workflow clarity at 3. Tightening the audit section into an ordered procedure would lift it.

Suggestions

Convert the audit checklist into an ordered workflow with explicit validation checkpoints (e.g., fork-test → Slither → Echidna fuzz → review findings) so multi-step sequencing and feedback loops are clear.

Make the 'References' list navigable with links/paths or move protocol-specific post-mortems into a bundled references/ file to strengthen progressive disclosure.

DimensionReasoningScore

Conciseness

Dense, information-rich content (taxonomy table, attack classes each with a terse 'Lesson', checklist, tooling) that assumes competence and avoids padding; the narrative sentences are exploit-specific insight, not basic-concept explanation.

5 / 5

Actionability

Provides copy-paste-ready commands (forge fork test, slither, echidna-test), real Solidity snippets showing the vulnerable patterns, and a concrete 8-item audit checklist with specific checks like 'nonce-used mapping written BEFORE external token call'.

5 / 5

Workflow Clarity

The audit checklist is a reference catalog rather than a sequenced procedure with validation checkpoints; there is no validate→fix→retry loop or ordered audit workflow, so it sits at the 'steps present but checkpoints implicit' anchor.

3 / 5

Progressive Disclosure

Well-organized single file (~100 lines) with clear section headers and no nested references; a bundled-file structure is absent so it scores on section organization, with a minor gap being the unlinked external 'References' list.

4 / 5

Total

17

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and highly distinct, but it omits an explicit 'when to use' clause, which caps completeness at 3 per the rubric guideline. Adding a 'Use when auditing cross-chain bridges...' sentence would raise completeness.

Suggestions

Add an explicit 'Use when ...' clause naming the trigger contexts (e.g., 'Use when auditing cross-chain bridges, reviewing validator/relayer trust models, or investigating Wormhole/Ronin/Nomad-class exploits').

Reflect the operational guidance from the body (audit checklist, fork-based testing) into the description so the 'what' includes the actionable outcome, not just the attack catalog.

DimensionReasoningScore

Specificity

Lists five distinct concrete attack vectors — message-validation bypass, validator key compromise, reentrancy on claim, Merkle-proof forgery, signature replay — matching the 'multiple specific concrete actions; comprehensive coverage' anchor.

5 / 5

Completeness

The description gives a clear 'what' (bridge attack classes) but lacks any 'Use when...' clause or equivalent explicit trigger guidance; the cap for a missing 'when' applies, and 'understand why' only weakly implies use context.

3 / 5

Trigger Term Quality

Includes natural named-protocol terms a user would actually say (wormhole, ronin, harmony, merkle-proof, optimistic bridges, signature replay, reentrancy) plus synonyms, fitting 'comprehensive coverage of natural terms including synonyms'.

5 / 5

Distinctiveness Conflict Risk

'Cross-chain bridge attack' scoped with named protocols and specific vectors is a clear niche with distinct triggers and minimal overlap risk with other skills.

5 / 5

Total

18

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.