signature-replay

Signature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, highly actionable, and well-sequenced with verification checklists, but it is a monolithic single-file document that does not offload detail into referenced files despite a substantial volume of PoC templates and exemplars.

Suggestions

Split the PoC templates and 'Known exemplars' into separate reference files (e.g., references/poc-templates.md, references/exemplars.md) with one-level-deep, clearly signaled links from SKILL.md to improve progressive disclosure.

Add an explicit validate→fix→retry feedback loop to the audit workflow (e.g., 're-run grep after applying fixes to confirm no unguarded ecrecover remains') to lift workflow clarity.

Dimension	Reasoning	Score
Conciseness	Lean and code-forward; it assumes Claude's competence (does not re-explain ecrecover or EIP-712 basics) and nearly every line — bug pattern, fix, grep, PoC — earns its place; not below because there is no notable padding.	5 / 5
Actionability	Fully executable guidance: copy-paste Foundry PoC templates, concrete grep commands, remediation contract with OZ imports, and inline Solidity fixes covering the common cases; not below because guidance is specific and runnable.	5 / 5
Workflow Clarity	The 'Audit steps' section gives a clear numbered sequence with explicit verification checklists (reject address(0), use OZ ECDSA, re-derive domain separator); not 5 because there is no validate→fix→retry feedback loop tying findings back to re-running checks.	4 / 5
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and all content is inlined in one ~250-line file with good section headers but no external references; the PoC templates and exemplar list could be split out, fitting the 'content that should be separate is inline' anchor; not 4 because nothing is offloaded to separate files.	3 / 5
	Total	17 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-differentiated, listing five concrete signature-replay bug classes, but it omits an explicit 'Use when...' trigger clause, leaving the 'when' guidance only in metadata.

Suggestions

Append an explicit 'Use when...' trigger clause to the description (e.g., 'Use when auditing EIP-712 signatures, permits, meta-transactions, or cross-chain bridges for replay vulnerabilities') to satisfy the 'when' requirement and lift completeness.

Add natural synonyms users say (permit, meta-transaction, ERC-2612, signature malleability) to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain and lists five concrete attack sub-types ('missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay'), matching the comprehensive-coverage anchor; not below because coverage is broad, not above as 5 is the ceiling.	5 / 5
Completeness	Has a clear, concrete 'what' (five bug classes) but no 'Use when...' clause in the description — the trigger guidance lives only in metadata; the rubric caps completeness at 3 when explicit trigger guidance is missing, so not 4.	3 / 5
Trigger Term Quality	Natural auditor terms are present (signature replay, ecrecover, nonce, cross-chain replay) but a few natural synonyms (permit, meta-transaction) are absent and the description lacks the explicit 'Use when' trigger framing; not 5 because keyword coverage is not exhaustive, not 3 because the terms are clearly the ones practitioners say.	4 / 5
Distinctiveness Conflict Risk	'Signature replay attacks' with enumerated EIP-712/ecrecover sub-types carves a clear niche with minimal overlap risk against other smart-contract skills; not below because the triggers are specific and unique.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/contracts/signature-replay/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.