📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills defi-protocol-templates
📦
defi-protocol-templates
Content revision r2 High Risk ⚡ Contains scripts⚙️ External commands
Build Safer DeFi Protocol Prototypes
DeFi contracts are difficult to design and secure. This skill provides Solidity starting points for staking, AMMs, governance, and flash loans, with validation guidance.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "defi-protocol-templates" from https://skillstore.io/skills/sickn33-defi-protocol-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-defi-protocol-templates/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "defi-protocol-templates". Compare the staking and AMM examples for a rewards platform.
Expected outcome:
- Use staking when users deposit one asset to earn funded rewards.
- Use an AMM when users supply paired assets and traders need swaps.
- Define funding, withdrawal, token behavior, and emergency controls before implementation.
Using "defi-protocol-templates". Review the flash-loan example before local testing.
Expected outcome:
- Restrict callbacks to the trusted provider and validate the asset.
- Choose direct repayment or provider-initiated transfer and implement one complete flow.
- Test unauthorized callbacks, failed transfers, fee rounding, reentrancy, and insufficient repayment.
Using "defi-protocol-templates". Prepare the AMM template for a security review.
Expected outcome:
Add slippage limits and deadlines, use safe token transfers, document supported tokens, define invariants, and test adversarial transaction ordering.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
All 26 static findings are false positives caused by Solidity require statements and Markdown backticks, not dynamic loading, command execution, or reconnaissance. Semantic review found exploitable token-handling and receiver-authorization flaws, missing slippage protections, and a broken flash-loan repayment flow in examples described as production-ready.
1
Files scanned
475
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (5)
High
Unauthenticated Flash-Loan Callback Grants Token Allowance
The receiver accepts calls from any address and approves that caller to spend the requested asset. An attacker can request an allowance and drain held tokens.
The callback has no caller or asset validation and directly approves msg.sender for amount plus fee. This creates a clear unauthorized-spending path.
High
Unsafe ERC20 Transfer and Accounting Assumptions
Several contracts ignore ERC20 return values and update accounting from requested amounts. Failed or fee-charging transfers can create unbacked balances, shares, or payouts.
The examples call transfer and transferFrom without SafeERC20 or return checks, while state changes use nominal inputs. Nonstandard ERC20 behavior makes the accounting unsafe.
High
AMM Omits User Slippage and Deadline Controls
Liquidity and swap functions accept no minimum return or deadline. Users cannot constrain adverse price movement, enabling sandwich losses and stale execution.
The public AMM methods expose only amounts and token selection. No minimum shares, minimum output, maximum input, or transaction deadline is enforced.
Medium
Flash-Loan Repayment Flow Is Inconsistent
The receiver grants an allowance, but the provider never pulls repayment. The sample receiver therefore leaves the provider balance unchanged and positive-fee loans revert.
The provider only checks its final balance, while the receiver only calls approve. No transferFrom or direct repayment connects those operations.
Medium
Unaudited Examples Are Presented as Production-Ready
The skill calls these templates production-ready despite exploitable authorization and token-accounting flaws. This claim may encourage unsafe deployment without required hardening.
The production-ready claim is explicit, while the document itself recommends testing and professional audits and contains concrete exploitable flaws.
Risk Factors
⚡ Contains scripts (16)
⚙️ External commands (8)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-defi-protocol-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-defi-protocol-templates?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-defi-protocol-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-defi-protocol-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-defi-protocol-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). defi-protocol-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-defi-protocol-templates/audits/5BibTeX citation
@techreport{sickn33-sickn33-defi-protocol-templates-2026,
author = {sickn33},
title = {defi-protocol-templates security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-defi-protocol-templates/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "defi-protocol-templates security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-defi-protocol-templates/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-defi-protocol-templates:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
wshobson Recommended
wshobson-defi-protocol-templates
Skillstore Score 71
Evidence Confidence High
Skillstore usage 14
Updated
2026-08-21
sickn33 Current
sickn33-defi-protocol-templates
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Prototype a DeFi Contract
Adapt a staking or AMM example into an initial design for local testing.
Compare Protocol Components
Review reward, liquidity, voting, and callback patterns before selecting an architecture.
Plan a Security Review
Identify missing controls and create a hardening checklist before implementation.
Try These Prompts
Choose a Template
Explain which included template best fits [protocol idea]. List required inputs, key assumptions, and the first tests to write.
Adapt a Staking Design
Adapt the staking example for [staking token] and [reward token]. Define reward funding, duration, withdrawal rules, and test cases without claiming production readiness.
Review an AMM
Review the AMM template for slippage, token compatibility, reserve accounting, reentrancy, and economic attacks. Return prioritized changes and verification steps.
Create a DeFi Threat Model
Create a threat model for [protocol design]. Cover trust boundaries, privileged roles, oracle risks, governance capture, token behavior, invariants, and incident controls.
Best Practices
- Treat every template as a starting point and require independent security review before deployment.
- Add safe token transfers, explicit access control, slippage limits, timelocks, and emergency controls where appropriate.
- Test standard, fee-charging, rebasing, callback-enabled, and malicious token behavior against documented invariants.
Avoid
- Deploy the examples unchanged or describe them as audited contracts.
- Assume every ERC20 transfer succeeds or delivers the requested amount.
- Add protocol features before defining trust boundaries, economic invariants, and failure recovery.
Frequently Asked Questions
Are these contracts ready for mainnet?
No. They require dependency updates, protocol-specific design, extensive testing, economic analysis, and an independent security audit.
Which protocol examples are included?
The skill includes staking, AMM, governance token, basic governor, flash-loan provider, and receiver examples.
Does the skill include a lending implementation?
No. Lending appears in the stated scope and resource list, but no lending contract is present in this file.
Which OpenZeppelin version should I use?
Select a supported version first, then update imports, constructors, hooks, and overrides to match its documentation.
Can the skill perform a professional audit?
No. It can support review planning and identify common gaps, but it cannot replace independent expert assessment.
What should I test first?
Start with authorization, accounting invariants, token transfer failures, reentrancy, rounding, slippage, governance boundaries, and emergency behavior.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/defi-protocol-templatesRef
f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
Maintenance freshness
7/26/2026
Usage
8 downloads · 99 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
defi-expert
78Review DeFi Protocol Integrations
by BarisSozen
DeFi integrations often fail because token units, decimals, and protocol formats are easy to mix up. This skill guides Claude, Codex, and Claude Code through checks for safer protocol code.
Coding & Development View
📦
starknet-js
83Build Starknet Apps with starknet.js
by internet-court
Starknet integrations require precise provider, account, transaction, and fee handling across several APIs. This skill provides focused starknet.js v9.x patterns for reliable TypeScript applications.
Coding & Development View
📦
nft-standards
78Build NFT Standards for Smart Contracts
by wshobson
NFT projects need correct token standards, metadata, royalties, and marketplace compatibility. This skill provides Solidity patterns for ERC-721, ERC-1155, soulbound tokens, dynamic NFTs, royalties, and metadata.
Coding & Development View
📦
pitfalls-blockchain
78Improve Blockchain Integration Safety
by BarisSozen
Blockchain integrations often fail through weak RPC handling, bad gas assumptions, or unsafe transaction flow. This skill gives Claude, Codex, and Claude Code focused review guidance for safer smart contract interactions.
Coding & Development View
📦
chaingpt
78Build ChainGPT Web3 AI Apps
by internet-court
Web3 developers need clear API guidance for ChainGPT products before they write integration code. This skill summarizes endpoints, SDKs, costs, and implementation patterns for ChainGPT-powered applications.
Coding & Development View
📦
direct-tests
77Write Fast GenLayer Direct Tests
by internet-court
GenLayer contract testing can be slow when every change needs a full node or container. This skill helps Claude, Codex, and Claude Code create focused direct mode tests with pytest fixtures, mocks, and VMContext controls.
Coding & Development View