external-call-safety

v1.0.0

Detects unsafe external call patterns and token integration vulnerabilities in smart contracts. Covers unchecked call return values, fee-on-transfer tokens, rebasing tokens, missing ERC20 return values (USDT), ERC-777 callback risks, unsafe approve patterns, return data bombs, and pull vs push payment analysis. Addresses OWASP SC06.

Claude Code1 skill

by QuillShield117updated 4 months ago

Source

$ git clone https://github.com/quillai-network/quillshield_skills

Clone the source, then follow the repository's marketplace instructions for your runtime. The plugin root is plugins/external-call-safety/ inside the repository.

Layout

plugins/external-call-safety/

├── .claude-plugin/plugin.json
└── skills/external-call-safety/SKILL.md

Skills1

external-call-safetyskills/external-call-safety/SKILL.md

Detects unsafe external call patterns and token integration vulnerabilities in smart contracts. Covers unchecked call/delegatecall/staticcall return values, fee-on-transfer tokens, rebasing tokens, tokens with missing return values (USDT), ERC-777 callback risks, unsafe approve race conditions, return data bombs, gas stipend limitations, and push vs pull payment patterns. Use when auditing contracts that interact with external contracts, integrate arbitrary ERC20 tokens, distribute payments, or make low-level calls.

Manifests1

plugins/external-call-safety/.claude-plugin/plugin.json

{
  "name": "external-call-safety",
  "version": "1.0.0",
  "description": "Detects unsafe external call patterns and token integration vulnerabilities in smart contracts. Covers unchecked call return values, fee-on-transfer tokens, rebasing tokens, missing ERC20 return values (USDT), ERC-777 callback risks, unsafe approve patterns, return data bombs, and pull vs push payment analysis. Addresses OWASP SC06.",
  "author": {
    "name": "QuillShield",
    "url": "https://github.com/quillai-network"
  }
}