メニュー
Protocol Type Trigger nft (detected when ERC721/ERC1155 with marketplace, minting, staking, or collateral logic found) - Inject Into Breadth agents, depth-token-flow, depth-edge...
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/PlamenTSV/plamen --skill nft-protocol-securityコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
Trigger STABLESWAP_FORK flag (fork-ancestry detects Curve/StableSwap parent via get_d/get_y/ramp_a/StableSwap patterns) - Agent Type general-purpose (standalone niche agent, 1 budget slot)
SKILL.md を表示中
SOC 職業分類に基づく
| name | nft-protocol-security |
| description | Protocol Type Trigger nft (detected when ERC721/ERC1155 with marketplace, minting, staking, or collateral logic found) - Inject Into Breadth agents, depth-token-flow, depth-edge... |
Protocol Type Trigger:
nft(detected when ERC721/ERC1155 with marketplace, minting, staking, or collateral logic found) Inject Into: Breadth agents, depth-token-flow, depth-edge-case Language: EVM only (Solana/Move NFT models use different mechanisms without callbacks or enumeration) Finding prefix:[NFT-N]
When decomposing this skill into depth agent investigation questions, map sections to domains:
Recon detects NFT protocol patterns: ERC721/ERC1155 with state-modifying logic beyond simple transfer (marketplace listing, staking, collateral, minting with conditions, royalty enforcement, batch operations).
Pure ERC721/ERC1155 token implementations without protocol logic do NOT trigger this skill.
For each function that triggers NFT callbacks:
Enumerate all code paths that invoke _safeMint, _safeTransfer, safeTransferFrom, or onERC1155Received/onERC1155BatchReceived:
| # | Function | Callback Triggered |
|---|
| State Modified BEFORE Callback |
|---|
| State Modified AFTER Callback |
|---|
| Reentrancy Guard? |
|---|
For each entry:
_safeMint(to, tokenId) → onERC721Received callback → recipient reverts if assigned token has undesirable properties → retry until desired properties assigned.For contracts implementing ERC1155:
onERC1155Received implemented for single transfers?onERC1155BatchReceived implemented for batch transfers?safeBatchTransferFrom will revert, blocking batch settlement/distribution.Tag: [TRACE:_safeMint → onERC721Received callback → state_before={list} → reentrant_path={YES/NO}]
For each approval mechanism:
approve(address, tokenId): per-token approval. Is approval cleared on transfer?setApprovalForAll(address, bool): blanket approval. Can an approved operator transfer ANY token?For each transfer function:
setApprovalForAll from users → contract can transfer any user's NFTs → compromise of contract = compromise of all approved NFTs.If royalties are enforced:
transferFrom vs marketplace executeSale)Tag: [TRACE:transfer_path={function} → auth_check={method} → royalty_enforced={YES/NO}]
For contracts using ERC721Enumerable or custom enumeration:
_ownedTokens, _allTokens, index mappings)_beforeTokenTransfer (OZ v4) or _update (OZ v5) without calling super → index structures become stale.tokenOfOwnerByIndex still return correct values? Is totalSupply decremented?For batch mint/burn/transfer:
Tag: [BOUNDARY:burn_last_token → _ownedTokens[owner].length={0} → tokenOfOwnerByIndex={result}]
If tokenURI or uri returns dynamic content:
uri(uint256 id) return a template with literal {id} placeholder per spec? Or a fully resolved URL? (clients expect to substitute the zero-padded hex ID client-side)If tokens have properties assigned at mint time (rarity, type, attributes):
When tokens are deposited into protocol custody (staking, collateral, escrow):
ownerOf(tokenId) return the protocol address or the depositor?Tag: [TRACE:mint → property_assignment={method} → randomness_source={source} → manipulable={YES/NO}]
_safeMint/_safeTransfer: is critical state updated BEFORE the callback?uri() follow the spec for the token standard used?ownerOf?_safeMint within nonReentrant modifier → callback reentrancy blockedERC721Enumerable or ERC1155 without overriding internal hooks → indices maintained by parent| Section | Required | Completed? | Notes |
|---|---|---|---|
| 1. Callback Reentrancy Surface | IF safe mint/transfer used | Callback inventory, batch completeness | |
| 2. Approval and Transfer Paths | YES | Authorization, scope, royalty bypass | |
| 3. Enumeration and Index Integrity | IF enumerable | Index consistency across operations | |
| 4. Metadata and State Consistency | YES | URI spec, property assignment, custody |