Find plugins

Multi-dimensional smart contract security auditing using Behavioral State Analysis (BSA). Combines behavioral intent extraction, parallel threat engines (economic, access control, state integrity), adversarial simulation with PoC generation, and Bayesian confidence scoring.

Detects Denial of Service and griefing vulnerabilities in smart contracts — OWASP SC10. Covers unbounded loops, block gas limit exhaustion, external call failure DoS, insufficient gas griefing (63/64 rule), storage bloat, timestamp griefing, self-destruct force-feeding, and push vs pull payment pattern analysis.

Detects unsafe external call patterns and token integration vulnerabilities in smart contracts. Covers unchecked call return values, fee-on-transfer tokens, rebasing tokens, missing ERC20 return values (USDT), ERC-777 callback risks, unsafe approve patterns, return data bombs, and pull vs push payment analysis. Addresses OWASP SC06.

Detects input validation failures and arithmetic vulnerabilities in smart contracts — the #1 direct exploitation cause at 34.6% of cases. Covers missing zero-checks, precision loss from division-before-multiplication, rounding direction exploitation, ERC4626 inflation attacks, unsafe casting, dust amount exploitation, and Solidity 0.8+ edge cases in unchecked blocks.

Detects price oracle manipulation and flash loan attack vectors in DeFi smart contracts. Classifies oracle trust models (Chainlink, TWAP, spot price), identifies stale price risks, circular dependencies, and flash loan atomicity exploitation patterns. Covers the #2 OWASP Smart Contract vulnerability category.

Detects vulnerabilities in upgradeable proxy smart contracts — storage layout collisions, uninitialized implementations, function selector clashing, and upgrade path safety issues. Covers Transparent, UUPS, Beacon, Diamond (EIP-2535), and Minimal proxy patterns. Critical for the 54.2% of Ethereum contracts that use proxy architecture.

Systematic detection of all reentrancy variants in smart contracts — classic, cross-function, cross-contract, and read-only reentrancy. Verifies CEI pattern compliance, traces external call positions relative to state changes, and detects callback-based attack vectors through ERC-777/ERC-1155 hooks.

Detects logic vulnerabilities in smart contracts by analyzing guard-state consistency patterns. Uses the Consistency Principle to find functions that bypass security checks (require, modifiers) established by the contract's own patterns.

Detects signature replay vulnerabilities in smart contracts — the vulnerability class affecting 19.63% of signature-using contracts. Covers same-chain, cross-chain, and cross-contract replay attacks, EIP-712 domain separator verification, nonce management analysis, ecrecover edge cases, permit/permit2 safety, and meta-transaction security.

Detects broken mathematical relationships between state variables in smart contracts. Automatically infers invariants (sum, conservation, ratio, monotonic, synchronization) then finds functions that violate them. Catches unauthorized minting, broken tokenomics, and accounting desynchronization.

Knowledge work superpowers that compound over time. Research, execute, review, and capture learnings to make each task easier than the last.

Screenshot open browser tabs for visual debugging.

AI Unified Process plugin for the Angular/JPA stack

AI Unified Process plugin for C# and Blazor on .NET 10

AI Unified Process - stack-agnostic core methodology (requirements, entity model, use cases)

AI Unified Process plugin for the NestJS/Drizzle + Next.js stack

AI Unified Process plugin for the Vaadin/jOOQ stack

Deep research across Claude and Codex in parallel with cross-pollination refinement

Agent Skills for Nsight Systems, Nsight Compute, and PyTorch/Kineto profile analysis with the VeloQ CLI.

A curated skills plugin for practical AI-era craft, judgment, and delivery.

Weaviate plugin for Claude Coding

Agent skills for Neo4j — Cypher queries, graph modeling, drivers, imports, GraphRAG, GDS, vector indexes, Aura provisioning, and more.

Consult distilled personas of colleagues — build them from Slack history (distill-slack-persona), get a single colleague's take (ask-colleague), or convene a deliberating panel (ask-team).

BPX Codex plugin for Unreal Engine asset inspection and safe edit workflows.