npx skills add smithery/flux-point-studios --skill aiken-dex-security-audit
flux-point-studios/cardano-agent-skills
aiken-dex-security-audit
Adversarial security audit playbook for Plutus V3 Aiken DEX contracts (threat model, invariants, findings, tests, tx repro shapes).
Installation
$
npx skills add flux-point-studios/cardano-agent-skills --skill aiken-dex-security-audit
Similar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
agent-browser
Shared topics
vercel-labs/agent-browser
Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…
810.4K installs
supabase-postgres-best-practices
Shared topics
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …
391.6K installs
vercel-react-best-practices
Shared topics
vercel-labs/agent-skills
697.8K installs
web-design-guidelines
Shared topics
vercel-labs/agent-skills
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…
617.3K installs
microsoft-foundry
Shared topics
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …
576.5K installs
azure-diagnostics
Shared topics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …
568.9K installsAlso in this package
Other skills from flux-point-studios/cardano-agent-skills · top by installs.
npx skills add flux-point-studios/cardano-agent-skills
More details
Agent compatibility
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Claude Code
Not declared
Cursor
Not declared
Codex
Not declared
GitHub Copilot
Not declared
Windsurf
Not declared
Gemini CLI
Not declared
Cline
Not declared
OpenCode
Not declared
Also listed on
Alternate registries and mirrors of this skill.
Repository health
Stars
8
License
LICENSE
Default branch
main
Open issues
1
Status
Active
Skill metadata
Parsed from SKILL.md frontmatter.
More metadata
- domain
- cardano
- language
- aiken
- category
- security-audit
Package contents
Files included with this skill beyond the listing page.
-
skill md
SKILL.md3,006 B -
docs
SUMMARY.md163 B
History
- First seen on skills.sh
- First recorded snapshot · 22 installs
SKILL.md
aiken-dex-security-audit
When to use
- Auditing Plutus V3 Aiken contracts for a DEX (validators + minting policies)
- You need a rigorous report: threat model, invariants, findings, and reproducible exploit tx shapes
Non-negotiable rules
- No hallucinations. If something isn't in the repo or inputs, say unknown and list exactly what's missing.
- Assume a hostile attacker can craft arbitrary transactions: multi-input, multi-action, weird datums, weird token bundles.
- Never ask for or handle seed phrases / private keys.
- Prefer evidence over vibes: minimal tx shape + failing test + fix + passing test.
Required inputs (ask for anything missing)
- Script list + purpose (spend/mint/reward/cert) and which are critical path for swaps/liquidity
- Datum/redeemer schemas (Aiken types + encoding expectations)
- Parameters/config: policy IDs, script hashes, upgrade/admin controls, oracle deps (if any)
- Off-chain tx builder(s) in scope (where swaps/liquidity txs are constructed)
- Network assumptions (mainnet/preprod) + constraints (tx size, exunits, reference scripts, inline datums)
Audit workflow (do ALL)
- Build a system model
- Map state UTxOs, assets, script addresses, and transitions (inputs/outputs/mint/burn/signees/time).
- Extract explicit invariants (testable)
- Value conservation, LP supply rules, fee bounds/rounding, auth rules, "exactly-one state UTxO", bounded datum/value growth.
- Threat model & attack surface
- Attacker capabilities in eUTxO; trusted roles; upgrade/emergency keys; oracles; economic/griefing vectors.
- Manual on-chain review
- For each validator/policy branch: what must be true about inputs/outputs/minted/signers/time? - Hunt: double satisfaction, fake-state UTxOs, asset-class mismatches, optional datum gotchas, unbounded growth, time-range bugs, division/rounding/negative amounts, "exactly one" enforcement bugs. - For each issue: minimal exploitable tx shape + why it works (use tx-shapes template).
- Off-chain review (if in scope)
- Ensure builder cannot construct valid-but-unsafe txs or mis-hash datums or mis-handle mint fields.
- Evidence suite (Aiken-first)
- Add unit tests + property tests for each invariant + each exploit regression test.
- Budget & DoS analysis
- Identify evaluation hotspots and griefing paths; recommend safe refactors.
- Report
- Use templates/audit-report.md and include: scope, assumptions, invariants, findings table, patches, tests, deployment checklist.
Files to use
- Full framework prompt:
references/audit-framework.md - Report template:
templates/audit-report.md - Invariants checklist:
templates/invariants-checklist.md - Minimal exploit tx shapes:
templates/tx-shapes.md