valory-xyz

Triage open security alerts on the current GitHub repo — both Dependabot (dependency CVEs) and Code Scanning (CodeQL / SnykCode / other tools that emit to GitHub's code-scanning API). For each alert, decide whether the bug's threat model is actually exploitable given this codebase's archetype, calling code, and reachability. Applicable findings get a tracking issue opened; not-applicable findings get dismissed with the appropriate per-source reason (`inaccurate` / `not_used` for Dependabot; `false positive` / `used in tests` for Code Scanning). Repo-agnostic — works across the Valory fleet.

Bump `open-autonomy` and `open-aea` (and their plugins / upstream-pin tags) to the latest released versions across any Valory downstream repo. Reads HISTORY.md + upgrading.md for both frameworks, applies code changes to dev packages only for OA/OAEA breaking changes, bumps version pins everywhere, then syncs third-party hashes from all upstream repos.

Audit open-autonomy FSM apps for correctness and safety

Audit all external HTTP requests in an open-autonomy agent service for resilience — failure modes, FSM propagation, crash/stuck/side-effect classification, and prioritized fix plan

Security review of an open-autonomy agent service — cryptographic key handling, dynamic code execution, ABCI authentication and replay, secret exposure, dependency supply chain, and deployment hardening

Post-implementation self-review checklist. Use after completing a coding phase to audit imports, styling, design compliance, and test coverage before requesting human review.

Write frontend unit tests for business logic — hooks, context providers, services, utilities, and components. Use when the user asks to write tests, add test coverage, or test a specific hook/provider/service/component. Triggers on tasks involving testing, test coverage, unit tests, or test files.

Codebase discovery checklist before writing frontend code. Use when starting a new feature, screen, or component. Reads UI wrappers, colors, SCSS, hooks, services, and test factories.

Run the strict pre-commit checklist for middleware changes, resolve issues, and rerun relevant checks before commit.

Use this skill to gain a deep technical understanding of the `olas-operate-middleware` codebase before proposing or doing any implementation work. This skill emphasizes code exploration and detailed specification writing to ensure implementation-ready outputs.