Skip to main content
chain-forensics On-chain analysis and transaction forensics for blockchain security investigations. Provides capabilities for tracing fund flows, identifying suspicious patterns, MEV analysis, and generating forensic reports for incident response.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/a5c-ai/babysitter --skill chain-forensicsO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Explorador de arquivos
2 arquivos Mais deste repositório Reference for querying the Atlas knowledge graph through its MCP tools — the SECONDARY enrichment/comparison layer that adds best-practice context to systems you have ALREADY scanned from your real sources (`az`, repos, dirs). Use when you need to look up nodes, edges, kinds, clusters, stats, or wiki pages in Atlas to compare against your real inventory. (atlas graph, query atlas, atlas mcp, search the graph, graph neighbors, atlas record, atlas kinds, enrichment layer)
Atlas turns your STATED NEED into a real systems atlas by SCANNING your actual sources (Azure via `az`, git repos, local dirs) and process/data mining them, THEN enriching against the Atlas knowledge graph. Use this skill when asked to inventory/map your real systems, scan your cloud + repos + directories, mine the real processes or data they contain, or collect their real constraints/gotchas. (atlas, scan my systems, inventory our azure account, map my repos, real systems atlas, process mining, data mining, collect nuances, system discovery)
assimilate-popular-workflows This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
name chain-forensics description On-chain analysis and transaction forensics for blockchain security investigations. Provides capabilities for tracing fund flows, identifying suspicious patterns, MEV analysis, and generating forensic reports for incident response. allowed-tools Read, Grep, Write, Bash, Edit, Glob, WebFetch, WebSearch graph {"domains":["domain:security"],"specializations":["specialization:cryptography-blockchain"],"skillAreas":["skill-area:blockchain-analytics-explorer","skill-area:incident-response-forensics","skill-area:on-chain-data-oracle-integration"],"roles":["role:security-engineer","role:security-risk-analyst"]}
Chain Analysis/Forensics Skill
Expert on-chain analysis and transaction forensics for security investigations and incident response.
Capabilities
Transaction Tracing : Follow fund flows across addresses and protocolsPattern Detection : Identify suspicious patterns (wash trading, rugpulls, sandwich attacks)MEV Analysis : Analyze MEV activity and flashbots bundlesAddress Clustering : Group related addresses and identify ownershipCross-Chain Tracking : Track bridged assets across chainsForensic Reports : Generate detailed investigation reports
MCP/Tool Integration
Phalcon MCP Transaction analysis, exploit detection phalcon-mcp whale-tracker-mcp Large transaction monitoring whale-tracker bicscan-mcp Address risk scoring bicscan dune-analytics-mcp Custom queries, analytics dune Etherscan MCP Block explorer data etherscan
Transaction Tracing
Basic Flow Analysis
cast tx 0xTxHash --rpc-url $RPC
cast 4byte-decode $(cast tx 0xTxHash --rpc-url $RPC | grep input)
curl "https://api.etherscan.io/api?module=account&action=txlistinternal&txhash=0xTxHash&apikey=$KEY "
Tracing with Tenderly/Phalcon
const trace = await phalcon.analyzeTransaction (txHash);
const flows = {
valueTransfers : trace.transfers .filter (t =>value > 0 ),
tokenTransfers : trace.erc20Transfers ,
internalCalls : trace.calls .filter (c =>type === 'CALL' ),
delegateCalls : trace.calls .filter (c =>type === 'DELEGATECALL' )
};
Address Analysis
Profile Building const addressProfile = {
address : '0x...' ,
metrics : {
firstTransaction : '2022-01-15' ,
transactionCount : 1234 ,
uniqueInteractions : 56 ,
totalValueTransferred : '1000 ETH'
},
patterns : {
activeHours : [14 , 15 , 16 ],
frequentProtocols : ['Uniswap' , 'Aave' ],
averageTxFrequency : '5/day'
},
riskFlags : {
tornadoCashInteraction : false ,
sanctionedAddressInteraction : false ,
knownExploitPattern : false ,
highFrequencyTrading : true
},
clusters : [
{ address : '0x...' , confidence : 0.95 , reason : 'Funding source' },
{ address : '0x...' , confidence : 0.8 , reason : 'Common recipient' }
]
};
Clustering Heuristics
Deposit Address Reuse : Same deposit addresses across exchangesMulti-Input Transactions : Addresses used together in single txTiming Analysis : Coordinated transaction timingAmount Patterns : Matching amounts minus feesContract Interactions : Shared smart contract usage patterns
MEV Analysis
Sandwich Attack Detection
WITH potential_sandwiches AS (
SELECT
block_number,
transaction_index,
"from",
"to",
value ,
LAG ("from") OVER (PARTITION BY block_number ORDER BY transaction_index) as prev_from,
LEAD ("from") OVER (PARTITION BY block_number ORDER BY transaction_index) as next_from
FROM ethereum.transactions
WHERE block_number > {{start_block}}
)
SELECT *
FROM potential_sandwiches
WHERE prev_from = next_from
AND prev_from != "from"
Flashbots Bundle Analysis
const bundleAnalysis = {
bundleHash : '0x...' ,
transactions : [
{ index : 0 , type : 'frontrun' , profit : '0.5 ETH' },
{ index : 1 , type : 'victim' , loss : '0.3 ETH' },
{ index : 2 , type : 'backrun' , profit : '0.4 ETH' }
],
totalMEV : '0.9 ETH' ,
miner : '0x...' ,
minerPayment : '0.45 ETH'
};
Suspicious Pattern Detection
Rugpull Indicators const rugpullIndicators = {
contract : {
hasHiddenMint : true ,
hasDisableTrading : true ,
hasBlacklist : true ,
highOwnershipConcentration : true ,
unverifiedContract : true ,
recentDeployment : true
},
tokenMetrics : {
liquidityLocked : false ,
lockDuration : 0 ,
holderCount : 50 ,
top10HoldersPercent : 85
},
tradingPatterns : {
artificialVolume : true ,
sellPressure : 'high' ,
buyWallsArtificial : true
},
riskScore : 95
};
Wash Trading Detection
WITH transfers AS (
SELECT
"from",
"to",
contract_address,
value ,
block_time
FROM erc20_ethereum.evt_Transfer
WHERE contract_address = {{token_address}}
AND block_time > NOW() - INTERVAL '7 days'
)
SELECT
a."from" as trader,
COUNT (DISTINCT b."to") as counterparties,
SUM (a.value) as total_volume,
COUNT (* ) as trade_count
FROM transfers a
JOIN transfers b ON a."to" = b."from" AND a."from" = b."to"
WHERE a.block_time < b.block_time
AND b.block_time < a.block_time + INTERVAL '1 hour'
GROUP BY a."from"
HAVING COUNT (* ) > 10
ORDER BY total_volume DESC
Cross-Chain Tracking
Bridge Transaction Mapping const crossChainTrace = {
originChain : 'ethereum' ,
originTx : '0x...' ,
originAddress : '0x...' ,
bridge : 'Wormhole' ,
bridgeMessage : '0x...' ,
destinationChain : 'arbitrum' ,
destinationTx : '0x...' ,
destinationAddress : '0x...' ,
amount : '100 USDC' ,
timestamp : {
origin : '2024-01-15T10:00:00Z' ,
destination : '2024-01-15T10:15:00Z'
}
};
Multi-Chain Address Mapping
const multiChainProfile = {
primaryAddress : '0x...' ,
chainPresence : {
ethereum : { address : '0x...' , balance : '10 ETH' , txCount : 500 },
arbitrum : { address : '0x...' , balance : '5 ETH' , txCount : 200 },
optimism : { address : '0x...' , balance : '3 ETH' , txCount : 100 },
polygon : { address : '0x...' , balance : '1000 MATIC' , txCount : 50 }
},
bridgeHistory : [
{ from : 'ethereum' , to : 'arbitrum' , amount : '5 ETH' , date : '2024-01-10' },
{ from : 'ethereum' , to : 'optimism' , amount : '3 ETH' , date : '2024-01-12' }
]
};
Forensic Report Template # Blockchain Forensic Investigation Report
## Executive Summary
- **Investigation ID** : INV-2024-XXX
- **Date Range** : 2024-01-01 to 2024-01-15
- **Subject** : [Address/Protocol/Incident]
- **Conclusion** : [Brief finding]
## Key Findings
### 1. Fund Flow Analysis
[Diagram and description of fund movements]
### 2. Address Attribution
| Address | Attribution | Confidence | Evidence |
|---------|-------------|------------|----------|
| 0x... | Attacker | High | Funding pattern |
| 0x... | Mixer | Medium | Tornado Cash |
| 0x... | Exchange | High | Known deposit |
### 3. Timeline
| Timestamp | Event | Addresses | Amount |
|-----------|-------|-----------|--------|
| T+0 | Initial exploit | 0x... | 1000 ETH |
| T+1h | Consolidation | 0x... | 1000 ETH |
| T+2h | Mixer deposit | Tornado | 100 ETH |
### 4. Attack Vector
[Technical description of how the incident occurred]
### 5. Total Impact
- Funds Lost: $X
- Users Affected: Y
- Contracts Exploited: Z
## Appendix
- Full transaction list
- Address clustering data
- Supporting evidence
Process Integration This skill integrates with:
incident-response-exploits.js - Exploit investigationeconomic-simulation.js - Market impact analysissmart-contract-security-audit.js - Post-audit monitoring
Tools Reference
See Also
agents/incident-response/AGENT.md - Incident commander agentskills/bug-bounty/SKILL.md - Disclosure coordinationincident-response-exploits.js - Full incident process 