Guide · Agent skill
How to use the DeFi AMM Security Audit agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The defi-amm-security skill gives an AI agent a short Japanese-language checklist and a list of common vulnerability patterns for automated market maker (AMM) smart contracts, such as those behind Uniswap, Curve and Balancer. This guide explains what a skill is, how to install this one, how to ask for it in natural language, and what it can and cannot do. After reading, you will be able to add the skill to your agent and use it as a structured first-pass review checklist.
DeFi AMM Security Auditaffaan-m/ECC · MIT Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page. It contains SKILL.md.
- 2Unzip the skill folder. Unzip it into ~/.claude/skills/ for all projects, or into the project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Share the contract. Give the agent the AMM contract source or the specific functions you want reviewed.
- 5Ask in plain language. Request a review for flash-loan, slippage, sandwich, price manipulation, reentrancy or overflow issues.
- 6Check each finding. Verify every reported issue against the code and the checklist, since the skill runs no tests.
What the skill makes the agent do
A skill is a folder of instructions that an agent can load when a task matches it. This one contains a single file, SKILL.md. Once it is loaded, the agent knows a list of common AMM vulnerability classes and a checklist to apply when reviewing code.
The skill covers flash-loan attacks, missing slippage protection, sandwich attacks, price manipulation through on-chain price lookups, reentrancy, and integer overflow and underflow. When reviewing swap, mint or burn logic, the agent checks the code against these patterns and the checklist items, such as whether price references come from an oracle and whether the checks-effects-interactions pattern is used.
- Flash-loan attacks: contracts that assume a loan is repaid within the same block
- Slippage: users receiving unexpectedly unfavourable prices
- Reentrancy: state checked after external calls
- Price manipulation: trusting on-chain price references too much
- Checklist: oracle prices, flash-loan awareness, slippage protection, checks-effects-interactions, reentrancy guards, overflow handling, access control and role separation
Install the skill from the ZIP download
Download the ZIP for this skill from this page and unzip it. The skill is a folder containing SKILL.md, so you need to place that folder where your agent looks for skills.
For a personal install that applies to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder instead.
In the Claude apps you can also upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need a special command. Describe the task in plain language that mentions AMMs, DeFi contracts or the vulnerability types the skill covers, and the agent can match the request to the skill.
The skill's own description lists its scope, so requests that name swaps, mints, burns, flash loans, slippage or price manipulation are the most likely to load it. Name the contract or file you want reviewed so the agent knows what to read.
- Review my Uniswap-style swap function in contracts/Pool.sol for flash-loan and slippage issues.
- Check this mint and burn logic for price manipulation through on-chain price lookups.
- Go through the AMM security checklist against this router contract and tell me which items are missing.
- Explain how a flash-loan price manipulation attack would work on this pool, for learning purposes.
What the skill needs and how it runs
The skill lists no requirements. It runs no scripts and does not use the network, so it does not fetch external data or call tools. It is a written guide that the agent reads and applies to the code you provide.
Because it has no scripts, it cannot compile, test or simulate your contract. Everything it produces is reasoning over the code and the checklist.
- Requirements: none listed
- Runs scripts: no
- Uses network: no
- Files: SKILL.md only
Tips for getting useful results
Give the agent the complete contract source and the functions that move funds, not just a single line. Ask it to map each checklist item to the code, so you can see which items it found and which it could not confirm.
Treat the output as a starting list. Verify each finding yourself, and use the list to focus a deeper manual review or a professional audit.
- Include the full contract and any oracle or price-reading code.
- Ask for each checklist item to be marked as present, missing or unclear.
- Ask the agent to explain each finding so you can check the reasoning.
- Use the output to prepare for a professional audit, not to replace one.
What people use it for
- Checking a swap function for missing slippage protection before a testnet deployment
- Reviewing mint and burn logic for price values read directly from on-chain state
- Preparing a structured checklist before commissioning a full professional audit
- Studying how flash-loan price manipulation works as part of learning DeFi security
Frequently asked questions
How do I install the defi-amm-security skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
Does the defi-amm-security skill cost money or have a licence?
The source project is listed under the MIT licence. This page does not state any price, so check the directory listing for current terms.
What does the skill require to run?
The skill lists no requirements. It runs no scripts and does not use the network, so it adds only a SKILL.md file of guidance.
Can this skill replace a professional smart contract audit?
No. The skill is a brief checklist with no testing, tooling or verification, so it can miss real bugs and give false confidence. Use it to prepare for a deeper manual audit.
Is the skill written in English?
No, the skill file is written in Japanese. The agent can still apply it to code you provide, but you may want to read the checklist in Japanese or ask the agent to explain findings in English.
What are alternatives if I need deeper analysis of AMM code?
This skill only lists patterns. For deeper analysis you would need a professional audit or dedicated testing and verification tools, which this skill does not include.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are writing or reviewing AMM or DeFi contracts and want a structured checklist of common vulnerability classes, or if you are learning how DeFi exploits work. Do not rely on it to confirm that a contract is safe to hold real funds; choose a professional audit with testing and tooling for that.
Download the skill