security-review-web3
Security patterns for Web3 and blockchain applications — Solana wallet signature verification, transaction validation, smart contract interaction security, and checklist for DeFi/NFT features.
Security patterns for Web3 and blockchain applications — Solana wallet signature verification, transaction validation, smart contract interaction security, and checklist for DeFi/NFT features.
Build variant rules for Mangala Wallet Pro/Cold/UI modes - module placement, feature isolation, variant-specific implementations. Auto-applies when editing flavor modules or build configuration.
StoreKit 2 in-app purchases, subscriptions, and monetization for iOS apps. Use when implementing consumables, non-consumables, auto-renewable subscriptions, paywall UI, receipt validation, or App Store Connect configuration.
Official Moltbook Identity Registry interface. Verify yourself, lookup others, and build on-chain reputation.
Use when storing files or CAR files on Filecoin, setting up wallets for Filecoin storage, checking storage status, managing storage providers, or using the filecoin-pin CLI. Also use when user mentions Filecoin pinning, PDP proofs, or USDFC payments for storage.
Integrates and extends the ICPay crypto payments platform. Use when working with icpay-widget, icpay-sdk, payment links, merchant accounts, relay payments (recipient EVM/IC/Solana), X402 v2, refunds, split payments, email notifications, webhooks, demo.icpay.org, betterstripe.com sandbox (testnets), filter tokens/chains, WalletConnect QR and deep links, wallet adapters, currency for payment links and profile, WordPress plugins (Instant Crypto Payments, WooCommerce), registration on icpay.org, creating an account, API keys (publishable and secret), .env for keys, SDK events (icpay-sdk-transaction-completed for success, transaction lifecycle, method start/success/error), account and wallet balances (user-wallets/with-balances, SDK getAccountWalletBalances and getWalletsWithBalances), or any ICPay-related code in the icpay monorepo.
Expo and React Native patterns for mobile development with EAS Build, SDK integration, and native module configuration. Use when building Expo apps, configuring native features, or setting up app signing for store deployment.
Trade Bitcoin Runes on Odin.fun — check balances, buy/sell tokens, fund bots, and manage your ckBTC wallet. ALWAYS use this skill when asked about Odin.fun trading, wallet balances, or bot operations.
Use this skill when integrating Aztec wallet connectivity with @aztec/wallet-sdk, including discovery/session flows, secure-channel key exchange, extension handlers, encrypted messaging, and BaseWallet implementations.
Use when integrating Rust with other languages or runtimes: extern "C" FFI, C/C++ bindings (cxx), generating bindings with bindgen/cbindgen, exposing Rust to Python (PyO3/maturin), Node.js addons (napi-rs/Node-API), WebAssembly (wasm-bindgen/wasm-pack), or generating Swift/Kotlin/Python bindings (UniFFI).
Complete Meteora DeFi SDK suite for building liquidity pools, AMMs, bonding curves, vaults, token launches, and zap operations on Solana. Use when integrating DLMM, DAMM v2, DAMM v1, Dynamic Bonding Curves, Alpha Vaults, Zap, or Stake-for-Fee functionality.
Build NFT minting experiences with Manifold's client-sdk. Guides agents through campaign setup, custom minting websites (React/Next.js), minting bots (Node.js), and SDK integration into existing projects. Supports [`Edition`](https://docs.manifold.xyz/client-sdk/sdk/product/edition-product) and [`Blind Mint`](https://docs.manifold.xyz/client-sdk/sdk/product/blind-mint) products across Ethereum, Base, Optimism, Shape, Sepolia, and ApeChain. Use when building minting pages, mint bots, integrating Manifold NFT products, or helping users set up Manifold campaigns. NOT for deploying smart contracts, managing Manifold Studio settings, or non-minting blockchain operations.
Dune Sim API for real-time blockchain wallet and token lookups across EVM and SVM chains. Use when user asks about wallet balances, token prices, NFT holdings, DeFi positions, transaction history, wallet activity, token holders, stablecoins, or any real-time on-chain data for a specific address. Triggers: 'check wallet', 'token balance', 'NFT holdings', 'DeFi positions', 'transaction history', 'token holders', 'token price', 'stablecoin balance', 'wallet activity', or any request involving a blockchain address (0x... or Solana base58).
Sets up BMad Builder module in a project. Use when the user requests to 'install bmb module', 'configure BMad Builder', or 'setup BMad Builder'.
NetworkSim provides provider network intelligence using real NPPES data (8.9M providers). Use this skill for ANY request involving: (1) provider search by specialty or location, (2) facility search (hospitals, nursing homes, clinics), (3) NPI validation, (4) network adequacy assessment against CMS/NCQA standards, (5) healthcare desert identification, (6) provider density analysis, (7) network roster generation, (8) hospital or physician quality metrics, (9) cross-product provider assignment, (10) pharmacy network analysis.
Test security features and verify implementation before deployment. Use this skill when you need to test CSRF protection, rate limiting, input validation, verify security headers, run security audits, or check the pre-deployment security checklist. Triggers include "test security", "security testing", "verify security", "security checklist", "pre-deployment", "test CSRF", "test rate limit", "security verification".
Configures Python development workspace for MQL5 integration. Use when setting up MetaTrader 5 Python API, configuring mt5 package, or establishing MQL5-Python workflows.
MicroPython REPL usage, package management, module inspection, and interactive debugging for Universe 2025 (Tufty) Badge. Use when installing MicroPython packages, testing code interactively, checking installed modules, or using the REPL for development.
Provide liquidity on GMX V2 — deposit into GM pools and GLV vaults, withdraw, shift between pools, and query pool data across Arbitrum, Avalanche, and Botanix.
Declare and use Riverpod providers (Provider, FutureProvider, StreamProvider, NotifierProvider, AsyncNotifierProvider, StreamNotifierProvider); unmodifiable vs modifiable, top-level declaration, Ref, Notifier build method. Use when creating providers, choosing provider type, writing Notifier classes, or understanding Riverpod state. Use this skill whenever the user asks about Riverpod providers, provider types, or notifiers.
Use this skill when the user wants to manage Indigo stability pool positions. Triggers on: "stability pool", "deposit iUSD", "Indigo pool", "liquidation rewards", "stability account", "earn from liquidations". Use indigo-cdp-operator to sign.
Use this skill when the user asks about Indigo Protocol stats, TVL, APR, governance, or DEX yields. Triggers on: "Indigo TVL", "Indigo stats", "iUSD APR", "Indigo governance", "Indigo polls", "DEX yields for iAssets".
Use this skill when the user wants to borrow or create lending pools on FluidTokens. Triggers on: "FluidTokens", "borrow against NFT", "create lending pool", "borrow ADA", "borrow USDM", "collateral lending", "peer-to-pool lending". Supports ADA, FLDT, Snek, USDM, USDA, STRIKE, WMTX, HOSKY, wUSDC, wBTC, cAP3X.
"Protocol parameters: fetch pparams, understand fees, min-UTxO, execution budgets. Read-only diagnostics."