decipher-solidity-superpowers

Audit preparation gate for Solidity contracts before external security review. Use when preparing for external audit engagement, when creating audit scope documentation, or when the user says "prepare for audit", "audit package", "scope document", "what do auditors need", "I'm getting this audited", or "external security review". Enforces: complete audit package (scope, protocol overview, threat model, internal findings log, and coverage report) before engaging auditors. Produces professional-grade documentation that maximizes audit value and minimizes wasted auditor time on obvious issues.

Security review gate for completed Solidity contract implementations. Use after any contract implementation is complete and before marking work done, merging, or deploying. Triggers on: "review this contract", "security review", "is this secure?", "check for vulnerabilities", "audit this", "pen test this", or when any contract implementation is complete. Dispatches the reviewoor agent with full context: source code, interface, design doc, invariant list, and git diff if modifying an existing contract. All Critical and High severity findings must be resolved with regression tests before exiting this skill.

Gas optimization gate for Solidity contracts before deployment. Dispatches the optimizoor agent to run a full 8-category gas audit. Use when: tests pass and contract is ready for gas review, user asks "is this gas efficient?", "can we reduce gas costs?", "optimize gas", "check gas usage", or after any implementation change to a value-handling function. Covers: storage layout and slot packing, function visibility, calldata vs memory, loop optimization, arithmetic (unchecked), custom errors, compiler configuration, and event vs storage decisions. Produces a gas audit report with forge snapshot diff before deployment.

NatSpec documentation gate for Solidity contracts. Use when committing any function, error, event, state variable, or contract definition. Triggers on: "add docs", "document this function", "add natspec", "add comments", "what does this function do?", or any time a function is committed without documentation. Enforces: @notice, @dev, @param, @return on all public and external functions; @notice and @dev on all custom errors; @notice on all events; @notice on public state variables. Covers: quality rules for each field, cross-referencing patterns, security annotation requirements, and templates for every Solidity element type.

TDD implementation gate for Solidity smart contracts. Use after an approved design doc and committed interface exist. Triggers on: "implement this", "write the contract", "fill in the logic", "implement the interface", "code this up", or any intent to write Solidity implementation code. Enforces strict Red-Green-Refactor: no production code without a failing Forge test first. Covers: CEI pattern, custom errors, access control, SafeERC20, ReentrancyGuard, gas snapshots, and all implementation standards for Solidity ^0.8.20 with Foundry.

Gate-enforced design phase for Solidity smart contract development. Use this skill before writing ANY .sol file — contracts, interfaces, libraries, or upgradeable implementations. Triggers on: "write a contract", "design a vault", "build a staking system", "create a token", "plan this protocol", "what should the architecture be", "I want to build X on-chain", or any similar intent to create new Solidity code. Enforces: design doc → interface → approval before a single line of implementation code. The plan gate cannot be skipped, even for "simple" contracts.

Fuzz and invariant testing gate for Solidity contracts that handle value. Use for any contract involving deposits, withdrawals, minting, burning, swapping, lending, staking, or share accounting. Triggers on: "add fuzz tests", "write invariant tests", "property-based tests", "fork tests", "test this more thoroughly", "invariant suite", or when a contract handles ETH or ERC-20 tokens. Enforces: handler pattern, ghost variables, bound() usage, configured invariant runs, and fork tests pinned to block numbers. Covers ERC-4626 vaults, AMMs, lending markets, staking contracts, and any system where accounting conservation must hold.

Deployment gate for Solidity contracts. Use before any deployment to testnet, mainnet, or public fork environments. Triggers on: "deploy this contract", "run the deploy script", "let's go to testnet", "deploy to mainnet", "how do I deploy", "deployment configuration", or any mention of broadcasting transactions or deploy scripts. Enforces: forge script (not forge create), pre-deployment checklist, simulation before broadcast, on-chain verification, multisig ownership transfer, and deployment manifest generation. No manual deployments allowed.

Upgrade gate for proxy-based upgradeable Solidity contracts. Use before implementing or executing any proxy upgrade — adding V2 logic, preparing upgrade transactions, or changing implementations. Triggers on: "upgrade the contract", "add V2", "change implementation", "implement a new version", "proxy upgrade", "UUPSUpgradeable", "TransparentUpgradeableProxy", "storage layout collision", or any intent to modify a deployed upgradeable contract. Enforces: storage layout diff verification (forge inspect), no slot shifting or removal, __gap management, versioned initializers, fork test before mainnet upgrade, and multisig upgrade execution.

Master orchestrator for Solidity smart contract development workflows. Injected automatically at session start — do not invoke manually. Defines THE RULE: before responding to ANY Solidity- related message, check if a phase skill applies. If there is even a 1% chance a skill is relevant, invoke it first. Skills cover: contract design (solidity-planner), TDD implementation (solidity-builder), fuzz/invariant testing (solidity-tester), gas optimization (solidity-gas-optimizer), NatSpec documentation (solidity-natspec), deployment (solidity-deployer), proxy upgrades (solidity-upgrader), security review (solidity-code-reviewer), and external audit preparation (solidity-audit-prep).