How do I install the Aiken Dex Security Audit skill?

Run npx skillmds add majiayu000/aiken-dex-security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Aiken Dex Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Aiken Dex Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Aiken Dex Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Aiken Dex Security Audit?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Aiken Dex Security Audit by majiayu000

Name: Aiken Dex Security Audit
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

File contents

aiken-dex-security-audit

When to use

Auditing Plutus V3 Aiken contracts for a DEX (validators + minting policies)
You need a rigorous report: threat model, invariants, findings, and reproducible exploit tx shapes

Non-negotiable rules

No hallucinations. If something isn't in the repo or inputs, say unknown and list exactly what's missing.
Assume a hostile attacker can craft arbitrary transactions: multi-input, multi-action, weird datums, weird token bundles.
Never ask for or handle seed phrases / private keys.
Prefer evidence over vibes: minimal tx shape + failing test + fix + passing test.

Required inputs (ask for anything missing)

Script list + purpose (spend/mint/reward/cert) and which are critical path for swaps/liquidity
Datum/redeemer schemas (Aiken types + encoding expectations)
Parameters/config: policy IDs, script hashes, upgrade/admin controls, oracle deps (if any)
Off-chain tx builder(s) in scope (where swaps/liquidity txs are constructed)
Network assumptions (mainnet/preprod) + constraints (tx size, exunits, reference scripts, inline datums)

Audit workflow (do ALL)

Build a system model
- Map state UTxOs, assets, script addresses, and transitions (inputs/outputs/mint/burn/signees/time).
Extract explicit invariants (testable)
- Value conservation, LP supply rules, fee bounds/rounding, auth rules, "exactly-one state UTxO", bounded datum/value growth.
Threat model & attack surface
- Attacker capabilities in eUTxO; trusted roles; upgrade/emergency keys; oracles; economic/griefing vectors.
Manual on-chain review
- For each validator/policy branch: what must be true about inputs/outputs/minted/signers/time?
- Hunt: double satisfaction, fake-state UTxOs, asset-class mismatches, optional datum gotchas, unbounded growth, time-range bugs, division/rounding/negative amounts, "exactly one" enforcement bugs.
- For each issue: minimal exploitable tx shape + why it works (use tx-shapes template).
Off-chain review (if in scope)
- Ensure builder cannot construct valid-but-unsafe txs or mis-hash datums or mis-handle mint fields.
Evidence suite (Aiken-first)
- Add unit tests + property tests for each invariant + each exploit regression test.
Budget & DoS analysis
- Identify evaluation hotspots and griefing paths; recommend safe refactors.
Report
- Use templates/audit-report.md and include: scope, assumptions, invariants, findings table, patches, tests, deployment checklist.

Files to use

Full framework prompt: references/audit-framework.md
Report template: templates/audit-report.md
Invariants checklist: templates/invariants-checklist.md
Minimal exploit tx shapes: templates/tx-shapes.md

---name: aiken-dex-security-auditdescription: Adversarial security audit playbook for Plutus V3 Aiken DEX contracts (threat model, invariants, findings, tests, tx repro shapes).--- # aiken-dex-security-audit ## When to use - Auditing Plutus V3 Aiken contracts for a DEX (validators + minting policies) - You need a rigorous report: threat model, invariants, findings, and reproducible exploit tx shapes ## Non-negotiable rules - No hallucinations. If something isn't in the repo or inputs, say **unknown** and list exactly what's missing. - Assume a hostile attacker can craft arbitrary transactions: multi-input, multi-action, weird datums, weird token bundles. - Never ask for or handle seed phrases / private keys. - Prefer evidence over vibes: minimal tx shape + failing test + fix + passing test. ## Required inputs (ask for anything missing) 1. Script list + purpose (spend/mint/reward/cert) and which are critical path for swaps/liquidity 2. Datum/redeemer schemas (Aiken types + encoding expectations) 3. Parameters/config: policy IDs, script hashes, upgrade/admin controls, oracle deps (if any) 4. Off-chain tx builder(s) in scope (where swaps/liquidity txs are constructed) 5. Network assumptions (mainnet/preprod) + constraints (tx size, exunits, reference scripts, inline datums) ## Audit workflow (do ALL) 1. Build a system model - Map state UTxOs, assets, script addresses, and transitions (inputs/outputs/mint/burn/signees/time). 2. Extract explicit invariants (testable) - Value conservation, LP supply rules, fee bounds/rounding, auth rules, "exactly-one state UTxO", bounded datum/value growth. 3. Threat model & attack surface - Attacker capabilities in eUTxO; trusted roles; upgrade/emergency keys; oracles; economic/griefing vectors. 4. Manual on-chain review - For each validator/policy branch: what must be true about inputs/outputs/minted/signers/time? - Hunt: double satisfaction, fake-state UTxOs, asset-class mismatches, optional datum gotchas, unbounded growth, time-range bugs, division/rounding/negative amounts, "exactly one" enforcement bugs. - For each issue: minimal exploitable tx shape + why it works (use tx-shapes template). 5. Off-chain review (if in scope) - Ensure builder cannot construct valid-but-unsafe txs or mis-hash datums or mis-handle mint fields. 6. Evidence suite (Aiken-first) - Add unit tests + property tests for each invariant + each exploit regression test. 7. Budget & DoS analysis - Identify evaluation hotspots and griefing paths; recommend safe refactors. 8. Report - Use `templates/audit-report.md` and include: scope, assumptions, invariants, findings table, patches, tests, deployment checklist. ## Files to use - Full framework prompt: `references/audit-framework.md` - Report template: `templates/audit-report.md` - Invariants checklist: `templates/invariants-checklist.md` - Minimal exploit tx shapes: `templates/tx-shapes.md`

Frequently asked questions