[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJ3P2WCS0NKK2TM1ADSH8X":3,"skill-same:01M6FJ3P2WCS0NKK2TM1ADSH8X":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":39,"install":40,"resources":53},"01M6FJ3P2WCS0NKK2TM1ADSH8X","arb-injection",null,"BYOCB ArbInjectionSkill: Scan EVM smart contracts for arbitrary call injection vulnerabilities. Monitor chains in real-time or scan specific addresses.","kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcryptotooldev\u002Farb-injection\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27],"injection","arb injection","vulnerabilities","monitor","real-time","contracts","evm","scan","call","time","2026-11-10 10:12:30",false,"---\nname: arb-injection\ndescription: \"BYOCB ArbInjectionSkill: Scan EVM smart contracts for arbitrary call injection vulnerabilities. Monitor chains in real-time or scan specific addresses.\"\n---\n\n# BYOCB ArbInjectionSkill\n\n> ⚠️ **Educational Tool** — This skill is designed for Solidity\u002Fblockchain security researchers and auditors. Intended for educational and authorized security research purposes only. Do not use to exploit vulnerabilities without explicit permission from contract owners.\n\nDetects dangerous CALL\u002FDELEGATECALL patterns that allow arbitrary call injection attacks.\n\n## How It Works\n\nArbInjectionSkill runs **automatically in the background**, monitoring blockchain(s) for newly deployed contracts. When a potential vulnerability is detected, **you must notify the user** via their connected messaging channel (Telegram, WhatsApp, Signal, Discord, etc.).\n\n## Install\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FBringYourOwnBot\u002Farb-injection.git\ncd arb-injection\nnpm install\n```\n\n## Running the Monitor\n\nStart as a **background session** for continuous monitoring:\n\n```bash\nnode index.js \u003Cchain> [--no-llm]\n```\n\nChains: `eth`, `bsc`, `base`, `arb`, `op`, `polygon`, `hyper`\n\nThe monitor will:\n1. Subscribe to new blocks\n2. Detect contract deployments\n3. Scan bytecode for vulnerabilities\n4. Save findings to `.\u002Fresults\u002F`\n\n## Alerting Users\n\n**Critical requirement:** When a CRITICAL or HIGH vulnerability is flagged, notify the user immediately.\n\nCheck for new findings periodically (via heartbeat or cron):\n\n```bash\n# Find findings from last 30 minutes\nfind .\u002Fresults -name \"*.md\" -mmin -30\n```\n\nWhen new findings exist with verdict CRITICAL or HIGH:\n1. Read the `.md` report\n2. Verify it's not a known false positive (see below)\n3. Send alert via `message` tool to user's preferred channel\n\nExample alert:\n```\n? ArbInjection Alert: Potential vulnerability detected\n\nChain: BSC\nContract: 0x1234...abcd\nVerdict: CRITICAL\nRisk: Unprotected arbitrary CALL with user-controlled target\n\n[Link to explorer]\n```\n\n## Manual Scan\n\nScan a specific contract on-demand:\n\n```bash\nnode modules\u002Fscan-arbitrary-call.js \u003Caddress> --rpc \u003Cchain>\n```\n\n## Interpreting Results\n\n| Verdict | Action |\n|---------|--------|\n| **CRITICAL** | Alert user immediately |\n| **HIGH** | Alert user immediately |\n| **MEDIUM** | Review, alert if confirmed |\n| **LOW\u002FSAFE** | No alert needed |\n\nResults saved to `.\u002Fresults\u002F` as `.json` and `.md` files.\n\n## False Positives\n\n**Do NOT alert** for these patterns (safe by design):\n- Immutable DELEGATECALL targets (hardcoded address in bytecode)\n- EIP-1167 minimal proxies (clone pattern)\n- UUPS\u002FTransparent proxies with access control\n- DEX callbacks (uniswapV3SwapCallback, etc.)\n- Known safe contracts: Multicall3, 1inch, Uniswap, Permit2\n\n**Verify before alerting:** Check if the flagged CALL target is:\n- Hardcoded (immutable) → FALSE POSITIVE\n- From calldata\u002Fuser input → REAL VULNERABILITY\n\n## Environment\n\nOptional `.env` file:\n```\nANTHROPIC_API_KEY=sk-ant-...   # For LLM deep analysis\nBYBOB_OUTPUT=\u002Fcustom\u002Fpath      # Override results directory\n```\n\n## Maintenance\n\n**Daily update required.** Detection patterns and fixes are pushed frequently.\n\n```bash\ncd \u002Fpath\u002Fto\u002Farb-injection\ngit pull origin main\nnpm install  # If package.json changed\n```\n\nSchedule daily update check (09:00):\n```json\n{\n  \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * *\" },\n  \"payload\": { \"kind\": \"systemEvent\", \"text\": \"ArbInjectionSkill daily update: git pull and npm install\" },\n  \"sessionTarget\": \"main\"\n}\n```\n\n## Source\n\nRepository: https:\u002F\u002Fgithub.com\u002FBringYourOwnBot\u002Farb-injection  \nPart of the **BYOCB** (Bring Your Own ClawdBot) skill collection.\n","# BYOCB ArbInjectionSkill\n\n> ⚠️ **Educational Tool** — This skill is designed for Solidity\u002Fblockchain security researchers and auditors. Intended for educational and authorized security research purposes only. Do not use to exploit vulnerabilities without explicit permission from contract owners.\n\nDetects dangerous CALL\u002FDELEGATECALL patterns that allow arbitrary call injection attacks.\n\n## How It Works\n\nArbInjectionSkill runs **automatically in the background**, monitoring blockchain(s) for newly deployed contracts. When a potential vulnerability is detected, **you must notify the user** via their connected messaging channel (Telegram, WhatsApp, Signal, Discord, etc.).\n\n## Install\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FBringYourOwnBot\u002Farb-injection.git\ncd arb-injection\nnpm install\n```\n\n## Running the Monitor\n\nStart as a **background session** for continuous monitoring:\n\n```bash\nnode index.js \u003Cchain> [--no-llm]\n```\n\nChains: `eth`, `bsc`, `base`, `arb`, `op`, `polygon`, `hyper`\n\nThe monitor will:\n1. Subscribe to new blocks\n2. Detect contract deployments\n3. Scan bytecode for vulnerabilities\n4. Save findings to `.\u002Fresults\u002F`\n\n## Alerting Users\n\n**Critical requirement:** When a CRITICAL or HIGH vulnerability is flagged, notify the user immediately.\n\nCheck for new findings periodically (via heartbeat or cron):\n\n```bash\n# Find findings from last 30 minutes\nfind .\u002Fresults -name \"*.md\" -mmin -30\n```\n\nWhen new findings exist with verdict CRITICAL or HIGH:\n1. Read the `.md` report\n2. Verify it's not a known false positive (see below)\n3. Send alert via `message` tool to user's preferred channel\n\nExample alert:\n```\n? ArbInjection Alert: Potential vulnerability detected\n\nChain: BSC\nContract: 0x1234...abcd\nVerdict: CRITICAL\nRisk: Unprotected arbitrary CALL with user-controlled target\n\n[Link to explorer]\n```\n\n## Manual Scan\n\nScan a specific contract on-demand:\n\n```bash\nnode modules\u002Fscan-arbitrary-call.js \u003Caddress> --rpc \u003Cchain>\n```\n\n## Interpreting Results\n\n| Verdict | Action |\n|---------|--------|\n| **CRITICAL** | Alert user immediately |\n| **HIGH** | Alert user immediately |\n| **MEDIUM** | Review, alert if confirmed |\n| **LOW\u002FSAFE** | No alert needed |\n\nResults saved to `.\u002Fresults\u002F` as `.json` and `.md` files.\n\n## False Positives\n\n**Do NOT alert** for these patterns (safe by design):\n- Immutable DELEGATECALL targets (hardcoded address in bytecode)\n- EIP-1167 minimal proxies (clone pattern)\n- UUPS\u002FTransparent proxies with access control\n- DEX callbacks (uniswapV3SwapCallback, etc.)\n- Known safe contracts: Multicall3, 1inch, Uniswap, Permit2\n\n**Verify before alerting:** Check if the flagged CALL target is:\n- Hardcoded (immutable) → FALSE POSITIVE\n- From calldata\u002Fuser input → REAL VULNERABILITY\n\n## Environment\n\nOptional `.env` file:\n```\nANTHROPIC_API_KEY=sk-ant-...   # For LLM deep analysis\nBYBOB_OUTPUT=\u002Fcustom\u002Fpath      # Override results directory\n```\n\n## Maintenance\n\n**Daily update required.** Detection patterns and fixes are pushed frequently.\n\n```bash\ncd \u002Fpath\u002Fto\u002Farb-injection\ngit pull origin main\nnpm install  # If package.json changed\n```\n\nSchedule daily update check (09:00):\n```json\n{\n  \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * *\" },\n  \"payload\": { \"kind\": \"systemEvent\", \"text\": \"ArbInjectionSkill daily update: git pull and npm install\" },\n  \"sessionTarget\": \"main\"\n}\n```\n\n## Source\n\nRepository: https:\u002F\u002Fgithub.com\u002FBringYourOwnBot\u002Farb-injection  \nPart of the **BYOCB** (Bring Your Own ClawdBot) skill collection.\n",{"name":5,"description":7},"main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Fcryptotooldev\u002Farb-injection",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add kbarbel640-del\u002Fskills --skill arb-injection",{"tool":46,"command":47},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill arb-injection",{"tool":49,"command":50},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill arb-injection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcryptotooldev\u002Farb-injection\u002FSKILL.md",true,[54],{"path":55,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":59},"_meta.json","REFERENCE","参考文档",295,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcryptotooldev\u002Farb-injection\u002F_meta.json",[61,92,121,142,148,168],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":72,"publishedAt":28},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[67],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91],"crowd prompting","prompting","api","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","https","content","ai agents",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":103,"publishedAt":28},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[98],{"categoryNo":99,"categoryName":100,"taxonomyType":101,"taxonomyTypeDesc":102},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[104,75,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,80,120],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","openclaw","design","strategy","headless","compete","submit","matchmaking","use",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":130,"publishedAt":28},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":101,"taxonomyTypeDesc":102},"01JBSEEDCAT000000000000021","资料检索与研究",[131,132,133,134,135,136,137,76,138,118,120,139,75,140,141],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","read","http","via",{"skillNo":143,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":28},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[146],{"categoryNo":128,"categoryName":129,"taxonomyType":101,"taxonomyTypeDesc":102},[134,133,132,131,141,136,137,76,135,118,120,138,139,75,140],{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":28},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[155,156,157,158,159,160,161,162,163,164,165,166,167],"git","summary","git summary","commits","repository","win32","status","linux","contributors","true","quick","get","branches",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":28},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[174,175],{"categoryNo":99,"categoryName":100,"taxonomyType":101,"taxonomyTypeDesc":102},{"categoryNo":176,"categoryName":177,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000037","律师与法务",[179,180,23,181,76,182,183,33,184,139,185,186,187,188,189,89,190,191,192],"agent constitution","constitution","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]