菜单
Use when designing a new ChainShield Policy for a wallet, treasury, or protocol multisig. Walks through risk profile, rule selection, default values, and remediation hookup so the resulting policy enforces real protection without blocking routine ops.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when writing or reviewing Rust code in this repo. Covers the Cargo workspace layout, error handling, async patterns, serde wire shapes that must match the TypeScript scaffold byte-for-byte, and testing conventions specific to ChainShield.
Use when authoring or reviewing the onchain layer of ChainShield. Covers PolicyAnchor, optional EmergencyVault, custom-error patterns, OpenZeppelin imports, Foundry test conventions, and the Galileo testnet deploy flow. Solidity surface is intentionally small.
Use when starting Phase 2 work to add the 0G, KeeperHub, or Gensyn AXL adapter modules. Provides the verbatim entry points, environment variables, and the trait seam to plug into without disturbing the Phase 1 engine. Backend is Rust; sponsor calls go through traits with one impl per provider.
Use when reasoning about ERC-20 token approvals, transfers, or any code path that touches tokens on behalf of users. Catalogs the attack patterns that ChainShield is designed to prevent and the engine rules that defend against each.
Use when you encounter an EVM 4-byte function selector (0x followed by 8 hex chars at the start of calldata) and need to identify which function it represents, or when authoring a forbiddenSelectors policy rule. Provides a curated table of common selectors and a decoding workflow for unknown ones.
| name | policy-author |
| description | Use when designing a new ChainShield Policy for a wallet, treasury, or protocol multisig. Walks through risk profile, rule selection, default values, and remediation hookup so the resulting policy enforces real protection without blocking routine ops. |
A Policy is the contract between the user's intent and the risk gate. A bad policy either blocks legitimate work (loud, annoying, gets disabled) or allows the attack it was supposed to stop (silent, dangerous). This skill produces a policy that is right-sized for its owner.
{
"rules": {
"maxTransferEth": 0.5,
"maxDailyOutflowEth": 2,
"allowedDestinations": ["<known-good-1>", "<known-good-2>"],
"forbiddenSelectors": ["0xa22cb465", "0xf2fde38b", "0x715018a6"]
},
"remediation": {
"onBlock": ["revoke-all-approvals"],
"notifyChannels": ["discord-ops"]
}
}
Rationale: caps are tight relative to use; allowlist keeps daily ops smooth; admin-takeover selectors are blanket-forbidden.
{
"rules": {
"maxTransferEth": 50,
"maxDailyOutflowEth": 100,
"allowedDestinations": ["<cold-vault>", "<payroll-splitter>"],
"forbiddenSelectors": ["0xa22cb465", "0xf2fde38b", "0x715018a6", "0x095ea7b3"],
"approvalCapByToken": {
"<usdc-address>": "1000000000000"
}
},
"remediation": {
"onBlock": ["safe-vault-evac", "revoke-all-approvals"],
"notifyChannels": ["telegram-security", "discord-ops"]
}
}
Rationale: per-tx cap reflects the largest legit operation; daily cap is 2x that to allow paired moves; raw approve is forbidden in favor of explicit per-token caps; remediation moves funds and revokes approvals on any block.
{
"rules": {
"maxTransferEth": 0.1,
"maxDailyOutflowEth": 1,
"allowedDestinations": ["<single-target-protocol>"],
"forbiddenSelectors": ["0xa22cb465", "0xf2fde38b", "0x715018a6", "0x095ea7b3"]
},
"remediation": {
"onBlock": ["pause-automation", "safe-vault-evac"],
"notifyChannels": ["discord-ops"]
}
}
Rationale: the agent has one job; deviation from that job is suspicious and should pause the agent itself.
maxTransferEth with the answer to "largest legit single transfer". Round up by ~20% to avoid false positives.maxDailyOutflowEth with 2 * maxTransferEth for treasuries, or actual measured throughput for hot wallets.allowedDestinations with the answers from inputs 5 and 6. Address-checksum is not required; the engine compares case-insensitively.forbiddenSelectors. Add 0x095ea7b3 (approve) only if you ALSO add an approvalCapByToken entry for any token the owner needs to interact with; otherwise the owner cannot grant any allowance at all.remediation.onBlock with playbook ids that already exist in KeeperHub. The engine attempts each in order until one succeeds.remediation.notifyChannels with channel keys registered in the running engine (engineOptions.notificationChannels). Unregistered keys are silently dropped.POST /policies. The response includes a UUID; reference it from /evaluate calls.Before deploying, run these check intents through POST /evaluate:
| Intent | Expected verdict |
|---|---|
| Safe transfer to allowlisted destination, value <= cap | ALLOW |
| Same call, value just above cap | BLOCK |
Calldata starting with 0x095ea7b3 (approve) to a non-allowlisted token | BLOCK if approve is forbidden, else CONFIRM |
| Transfer to an unknown destination, value within cap | REQUIRE_HUMAN_CONFIRMATION |
If any check disagrees, fix the policy before going live.
maxTransferEth = maxDailyOutflowEth. The first legitimate tx exhausts the daily budget. Aim for at least 2x.allowedDestinations "to be permissive". Empty disables the rule entirely; it does not allow everything subject to other rules. Be explicit.forbiddenSelectors. The policy is only as strong as the rules that fire; admin-takeover selectors should never be on the path for routine ops.onBlock that do not exist in KeeperHub. The engine logs the failure but the block still stands.