[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70FST8HBN6BJBXB70RMQBMH":3,"skill-same:01M70FST8HBN6BJBXB70RMQBMH":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M70FST8HBN6BJBXB70RMQBMH","defi-amm-security",null,"Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math. Use when auditing or writing Solidity AMM, liquidity pool, or swap code.","mdnaimul22\u002Fhuman-skills","mdnaimul22","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F64520358?v=4","01M70FH95MH2H796Q01TYSFZ03","Naimul","01M70FH96798CQR4YHA13F17GA",3,"MIT","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fdefi-amm-security\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","amm","defi","defi amm security","contracts","when","for","attacks","flows","port","liquidity","adaptation","slippage","writing","math","direct","reentrancy","solidity","code","oracle","2026-11-10 10:12:30",false,"---\nname: defi-amm-security\ndescription: Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math. Use when auditing or writing Solidity AMM, liquidity pool, or swap code.\nmetadata:\n  version: \"1.0.0\"\n  origin: ECC direct-port adaptation\n---\n\n# DeFi AMM Security\n\nCritical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions.\n\n## When to Use\n\n- Writing or auditing a Solidity AMM or liquidity-pool contract\n- Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances\n- Reviewing any contract that uses `token.balanceOf(address(this))` in share or reserve math\n- Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol\n\n## How It Works\n\nUse this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants.\n\n## Execution Safety\n\nThe shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing\u002Fstatic-analysis jobs that may consume significant local or paid resources.\n\nNever include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports.\n\n## Examples\n\n### Reentrancy: enforce CEI order\n\nVulnerable:\n\n```solidity\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);\n    token.transfer(msg.sender, amount);\n    balances[msg.sender] -= amount;\n}\n```\n\nSafe:\n\n```solidity\nimport {ReentrancyGuard} from \"@openzeppelin\u002Fcontracts\u002Futils\u002FReentrancyGuard.sol\";\nimport {SafeERC20} from \"@openzeppelin\u002Fcontracts\u002Ftoken\u002FERC20\u002Futils\u002FSafeERC20.sol\";\n\nusing SafeERC20 for IERC20;\n\nfunction withdraw(uint256 amount) external nonReentrant {\n    require(balances[msg.sender] >= amount, \"Insufficient\");\n    balances[msg.sender] -= amount;\n    token.safeTransfer(msg.sender, amount);\n}\n```\n\nDo not write your own guard when a hardened library exists.\n\n### Donation or inflation attacks\n\nUsing `token.balanceOf(address(this))` directly for share math lets attackers manipulate the denominator by sending tokens to the contract outside the intended path.\n\n```solidity\n\u002F\u002F Vulnerable\nfunction deposit(uint256 assets) external returns (uint256 shares) {\n    shares = (assets * totalShares) \u002F token.balanceOf(address(this));\n}\n```\n\n```solidity\n\u002F\u002F Safe\nuint256 private _totalAssets;\n\nfunction deposit(uint256 assets) external nonReentrant returns (uint256 shares) {\n    uint256 balBefore = token.balanceOf(address(this));\n    token.safeTransferFrom(msg.sender, address(this), assets);\n    uint256 received = token.balanceOf(address(this)) - balBefore;\n\n    shares = totalShares == 0 ? received : (received * totalShares) \u002F _totalAssets;\n    _totalAssets += received;\n    totalShares += shares;\n}\n```\n\nTrack internal accounting and measure actual tokens received.\n\n### Oracle manipulation\n\nSpot prices are flash-loan manipulable. Prefer TWAP.\n\n```solidity\nuint32[] memory secondsAgos = new uint32[](2);\nsecondsAgos[0] = 1800;\nsecondsAgos[1] = 0;\n(int56[] memory tickCumulatives,) = IUniswapV3Pool(pool).observe(secondsAgos);\nint24 twapTick = int24(\n    (tickCumulatives[1] - tickCumulatives[0]) \u002F int56(uint56(30 minutes))\n);\nuint160 sqrtPriceX96 = TickMath.getSqrtRatioAtTick(twapTick);\n```\n\n### Slippage protection\n\nEvery swap path needs caller-provided slippage and a deadline.\n\n```solidity\nfunction swap(\n    uint256 amountIn,\n    uint256 amountOutMin,\n    uint256 deadline\n) external returns (uint256 amountOut) {\n    require(block.timestamp \u003C= deadline, \"Expired\");\n    amountOut = _calculateOut(amountIn);\n    require(amountOut >= amountOutMin, \"Slippage exceeded\");\n    _executeSwap(amountIn, amountOut);\n}\n```\n\n### Safe reserve math\n\n```solidity\nimport {FullMath} from \"@uniswap\u002Fv3-core\u002Fcontracts\u002Flibraries\u002FFullMath.sol\";\n\nuint256 result = FullMath.mulDiv(a, b, c);\n```\n\nFor large reserve math, avoid naive `a * b \u002F c` when overflow risk exists.\n\n### Admin controls\n\n```solidity\nimport {Ownable2Step} from \"@openzeppelin\u002Fcontracts\u002Faccess\u002FOwnable2Step.sol\";\n\ncontract MyAMM is Ownable2Step {\n    function setFee(uint256 fee) external onlyOwner { ... }\n    function pause() external onlyOwner { ... }\n}\n```\n\nPrefer explicit acceptance for ownership transfer and gate every privileged path.\n\n## Security Checklist\n\n- Reentrancy-exposed entrypoints use `nonReentrant`\n- CEI ordering is respected\n- Share math does not depend on raw `balanceOf(address(this))`\n- ERC-20 transfers use `SafeERC20`\n- Deposits measure actual tokens received\n- Oracle reads use TWAP or another manipulation-resistant source\n- Swaps require `amountOutMin` and `deadline`\n- Overflow-sensitive reserve math uses safe primitives like `mulDiv`\n- Admin functions are access-controlled\n- Emergency pause exists and is tested\n- Static analysis and fuzzing are run before production\n\n## Audit Tools\n\n```bash\npip install slither-analyzer\nslither . --exclude-dependencies\n\nechidna-test . --contract YourAMM --config echidna.yaml\n\nforge test --fuzz-runs 10000\n```\n","# DeFi AMM Security\n\nCritical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions.\n\n## When to Use\n\n- Writing or auditing a Solidity AMM or liquidity-pool contract\n- Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances\n- Reviewing any contract that uses `token.balanceOf(address(this))` in share or reserve math\n- Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol\n\n## How It Works\n\nUse this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants.\n\n## Execution Safety\n\nThe shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing\u002Fstatic-analysis jobs that may consume significant local or paid resources.\n\nNever include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports.\n\n## Examples\n\n### Reentrancy: enforce CEI order\n\nVulnerable:\n\n```solidity\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);\n    token.transfer(msg.sender, amount);\n    balances[msg.sender] -= amount;\n}\n```\n\nSafe:\n\n```solidity\nimport {ReentrancyGuard} from \"@openzeppelin\u002Fcontracts\u002Futils\u002FReentrancyGuard.sol\";\nimport {SafeERC20} from \"@openzeppelin\u002Fcontracts\u002Ftoken\u002FERC20\u002Futils\u002FSafeERC20.sol\";\n\nusing SafeERC20 for IERC20;\n\nfunction withdraw(uint256 amount) external nonReentrant {\n    require(balances[msg.sender] >= amount, \"Insufficient\");\n    balances[msg.sender] -= amount;\n    token.safeTransfer(msg.sender, amount);\n}\n```\n\nDo not write your own guard when a hardened library exists.\n\n### Donation or inflation attacks\n\nUsing `token.balanceOf(address(this))` directly for share math lets attackers manipulate the denominator by sending tokens to the contract outside the intended path.\n\n```solidity\n\u002F\u002F Vulnerable\nfunction deposit(uint256 assets) external returns (uint256 shares) {\n    shares = (assets * totalShares) \u002F token.balanceOf(address(this));\n}\n```\n\n```solidity\n\u002F\u002F Safe\nuint256 private _totalAssets;\n\nfunction deposit(uint256 assets) external nonReentrant returns (uint256 shares) {\n    uint256 balBefore = token.balanceOf(address(this));\n    token.safeTransferFrom(msg.sender, address(this), assets);\n    uint256 received = token.balanceOf(address(this)) - balBefore;\n\n    shares = totalShares == 0 ? received : (received * totalShares) \u002F _totalAssets;\n    _totalAssets += received;\n    totalShares += shares;\n}\n```\n\nTrack internal accounting and measure actual tokens received.\n\n### Oracle manipulation\n\nSpot prices are flash-loan manipulable. Prefer TWAP.\n\n```solidity\nuint32[] memory secondsAgos = new uint32[](2);\nsecondsAgos[0] = 1800;\nsecondsAgos[1] = 0;\n(int56[] memory tickCumulatives,) = IUniswapV3Pool(pool).observe(secondsAgos);\nint24 twapTick = int24(\n    (tickCumulatives[1] - tickCumulatives[0]) \u002F int56(uint56(30 minutes))\n);\nuint160 sqrtPriceX96 = TickMath.getSqrtRatioAtTick(twapTick);\n```\n\n### Slippage protection\n\nEvery swap path needs caller-provided slippage and a deadline.\n\n```solidity\nfunction swap(\n    uint256 amountIn,\n    uint256 amountOutMin,\n    uint256 deadline\n) external returns (uint256 amountOut) {\n    require(block.timestamp \u003C= deadline, \"Expired\");\n    amountOut = _calculateOut(amountIn);\n    require(amountOut >= amountOutMin, \"Slippage exceeded\");\n    _executeSwap(amountIn, amountOut);\n}\n```\n\n### Safe reserve math\n\n```solidity\nimport {FullMath} from \"@uniswap\u002Fv3-core\u002Fcontracts\u002Flibraries\u002FFullMath.sol\";\n\nuint256 result = FullMath.mulDiv(a, b, c);\n```\n\nFor large reserve math, avoid naive `a * b \u002F c` when overflow risk exists.\n\n### Admin controls\n\n```solidity\nimport {Ownable2Step} from \"@openzeppelin\u002Fcontracts\u002Faccess\u002FOwnable2Step.sol\";\n\ncontract MyAMM is Ownable2Step {\n    function setFee(uint256 fee) external onlyOwner { ... }\n    function pause() external onlyOwner { ... }\n}\n```\n\nPrefer explicit acceptance for ownership transfer and gate every privileged path.\n\n## Security Checklist\n\n- Reentrancy-exposed entrypoints use `nonReentrant`\n- CEI ordering is respected\n- Share math does not depend on raw `balanceOf(address(this))`\n- ERC-20 transfers use `SafeERC20`\n- Deposits measure actual tokens received\n- Oracle reads use TWAP or another manipulation-resistant source\n- Swaps require `amountOutMin` and `deadline`\n- Overflow-sensitive reserve math uses safe primitives like `mulDiv`\n- Admin functions are access-controlled\n- Emergency pause exists and is tested\n- Static analysis and fuzzing are run before production\n\n## Audit Tools\n\n```bash\npip install slither-analyzer\nslither . --exclude-dependencies\n\nechidna-test . --contract YourAMM --config echidna.yaml\n\nforge test --fuzz-runs 10000\n```\n",{"name":5,"metadata":49,"description":7},{"origin":50,"version":51},"ECC direct-port adaptation","1.0.0","main","74715deacdc69119d739f38916f8ee4f0f979ebf","skills\u002Fstorage\u002Faffaan-m_ECC\u002Fdefi-amm-security",0,"https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills","https:\u002F\u002Fgithub.com\u002Fmdnaimul22","AI Agents Workflows Automation | Specializing in Python, FastAPI, MCP Agents & Custom ERP.","2026-11-11 21:16:57",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add mdnaimul22\u002Fhuman-skills --skill defi-amm-security",{"tool":66,"command":67},"bunx","bunx skills add mdnaimul22\u002Fhuman-skills --skill defi-amm-security",{"tool":69,"command":70},"pnpm","pnpm dlx skills add mdnaimul22\u002Fhuman-skills --skill defi-amm-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fdefi-amm-security\u002FSKILL.md",true,[],[75,83,111,129,148,163],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":82},"01M72JT3YP1SQHD0MANGDXQ4RT","higgsfield-websites","Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website …`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1\u002FR2\u002FKV\u002FDO\u002FContainers). THREE product types, picked via `--type` on create: `website` (standalone, no Higgsfield integration — references\u002Fwebsite-flow.md), `app` (Sign in with Higgsfield + fnf SDK, Quanta — references\u002Fapp-flow.md), `game` (realtime multiplayer rooms — references\u002Fgame-flow.md). Routes to the right flow; each carries its own rules and deploy\u002Fpublish gates.\nUse when: \"build me a website\", \"make a landing page\", \"create a web app\", \"build a SaaS dashboard \u002F portfolio\", \"make me a game\", \"deploy this site\", \"publish\". Also owns GAME ART: \"make a spritesheet\", \"tileable texture\", \"animate a 3D character\", game music\u002FSFX — see the game-* references.\nNOT for: single image\u002Fvideo\u002Faudio generation (higgsfield-generate), product photos (higgsfield-product-photoshoot), marketplace cards (higgsfield-marketplace-cards).","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fhiggsfield-ai_skills\u002Fhiggsfield-websites\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":103,"publishedAt":44},"01M70JPK8HAXXA85P7Q8NKZZYG","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-skills\u002FSKILL.md",[89,94,97,100],{"categoryNo":90,"categoryName":91,"taxonomyType":92,"taxonomyTypeDesc":93},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":98,"categoryName":99,"taxonomyType":92,"taxonomyTypeDesc":93},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":101,"categoryName":102,"taxonomyType":92,"taxonomyTypeDesc":93},"01JBSEEDCAT000000000000008","测试与质量",[37,104,105,106,107,108,109,29,110],"writing skills","editing","deployment","use","Existing","new","work",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":120,"publishedAt":44},"01M70JP4PHBH1CQVVDWZ94W159","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-plans\u002FSKILL.md",[117,118,119],{"categoryNo":90,"categoryName":91,"taxonomyType":92,"taxonomyTypeDesc":93},{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[37,121,122,123,29,42,30,107,124,125,126,127,128],"writing plans","plans","you","requirements","task","multi","spec","multi-step task",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":44},"01M70JNTYVGXFZT8PASZ844TH8","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fverification-before-completion\u002FSKILL.md",[],[136,137,138,139,140,141,107,142,143,144,29,145,110,146,147],"verification","verification before completion","complete","about","output","assertions","prs","evidence","claim","claims","commands","running",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":44},"01M70JNGVSQDESWN0Q5BPJ875V","using-superpowers","Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-superpowers\u002FSKILL.md",[154],{"categoryNo":98,"categoryName":99,"taxonomyType":92,"taxonomyTypeDesc":93},[156,157,158,159,107,29,160,161,162],"using superpowers","superpowers","conversation","how to","how","find","questions",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M70JN57CE588NPYPYTWH1DWG","using-git-worktrees","Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-git-worktrees\u002FSKILL.md",[],[170,171,172,173,174,175,29,110,176,177,178,179,180,181,182,122,107,183,184],"using git worktrees","Using git","git","worktrees","git worktrees","implementation","git worktree","worktree","native","Tools","isolation","fallback","feature","via","workspace"]