Loading
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admi
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add trailofbits/skills --skill entry-point-analyzer -a cursor -y
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
Systematically identify all state-changing entry points in a smart contract codebase to guide security audits.
Use the available file-reading, search, and shell tools. Resolve bundled reference links relative to this SKILL.md, not the audited repository. Slither is optional; use manual inspection if it is unavailable or fails. Report unreadable source or reference files as coverage gaps. Runtime permissions come from the workspace.
Use this skill when:
Do NOT use this skill for:
This skill focuses exclusively on functions that can modify state. Excluded:
| Language | Excluded Patterns |
|---|---|
| Solidity | view, pure functions |
| Vyper | @view, @pure functions |
| Solana | Functions without mut account references |
| Move | Read-only function bodies; visibility alone does not establish mutability |
| TON | get methods (FunC), read-only receivers (Tact) |
| CosmWasm | query entry point and its handlers |
Include state-changing Move public fun even without entry: Aptos transaction
scripts and Sui programmable transaction blocks can reach them. Trace callees when
needed to determine state effects, and record signer, capability, and object
ownership requirements separately from visibility.
Why exclude read-only functions? They cannot directly cause loss of funds or state corruption. While they may leak information, the primary audit focus is on functions that can change state.
For Solidity codebases, Slither can automatically extract entry points. Before manual analysis:
which slither
slither . --print entry-points
This outputs a table of all state-changing entry points with:
If which slither returns nothing, proceed with manual analysis using the language-specific reference files.
| Extension | Language | Reference |
|---|---|---|
.sol | Solidity | references/solidity.md |
.vy | Vyper | references/vyper.md |
.rs + Cargo.toml with solana-program | Solana (Rust) | references/solana.md |
.move + Move.toml with edition | Move (Sui) | references/move-sui.md |
.move + Move.toml with Aptos | Move (Aptos) | references/move-aptos.md |
.fc, .func, .tact | TON (FunC/Tact) | references/ton.md |
.rs + Cargo.toml with cosmwasm-std | CosmWasm | references/cosmwasm.md |
Load the appropriate reference file(s) based on detected language before analysis.
Classify each state-changing entry point into one of these categories:
Functions with no caller-identity or role restriction. Record state conditions such as pause flags separately; they do not make a function privileged.
Functions limited to specific roles. Common patterns to detect:
admin, owner, governance, guardian, operator, manager, minter, pauser, keeper, relayer, lender, borroweronlyRole, hasRole, require(msg.sender == X), assert_owner, #[access_control]Functions whose enforced caller restrictions limit them to other contracts. Cite the actual check and the identity or provenance of the permitted caller. A callback name, implemented interface, or intended integration is not access control.
msg.sender != tx.origin establishes a call-path condition, not authentication
of a trusted protocol. Record that condition without inferring a trusted caller.Generate a markdown report with this structure:
# Entry Point Analysis: [Project Name]
**Analyzed**: [timestamp]
**Scope**: [directories analyzed or "full codebase"]
**Languages**: [detected languages]
**Focus**: State-changing functions only (view/pure excluded)
## Summary
| Category | Count |
|----------|-------|
| Public (Unrestricted) | X |
| Role-Restricted | X |
| Restricted (Review Required) | X |
| Contract-Only | X |
| **Total** | **X** |
---
## Public Entry Points (Unrestricted)
State-changing functions callable by anyone—prioritize for attack surface analysis.
| Function | File | Notes |
|----------|------|-------|
| `functionName(params)` | `path/to/file.sol:L42` | Brief note if relevant |
---
## Role-Restricted Entry Points
### Admin / Owner
| Function | File | Restriction |
|----------|------|-------------|
| `setFee(uint256)` | `Config.sol:L15` | `onlyOwner` |
### Governance
| Function | File | Restriction |
|----------|------|-------------|
### Guardian / Pauser
| Function | File | Restriction |
|----------|------|-------------|
### Other Roles
| Function | File | Restriction | Role |
|----------|------|-------------|------|
---
## Restricted (Review Required)
Functions with access control patterns that need manual verification.
| Function | File | Pattern | Why Review |
|----------|------|---------|------------|
| `execute(bytes)` | `Executor.sol:L88` | `require(trusted[msg.sender])` | Dynamic trust list |
---
## Contract-Only (Internal Integration Points)
Functions only callable by other contracts—useful for understanding trust boundaries.
| Function | File | Expected Caller |
|----------|------|-----------------|
| `onFlashLoan(...)` | `Vault.sol:L200` | Flash loan provider |
---
## Files Analyzed
- `path/to/file1.sol` (X state-changing entry points)
- `path/to/file2.sol` (X state-changing entry points)
When user specifies a directory filter:
src/core/" → scope = src/core/view, pure, and equivalent read-only functions.| Protocol Type | Common Roles |
|---|---|
| DEX | owner, feeManager, pairCreator |
| Lending | admin, guardian, liquidator, oracle |
| Governance | proposer, executor, canceller, timelock |
| NFT | minter, admin, royaltyReceiver |
| Bridge | relayer, guardian, validator, operator |
| Vault/Yield | strategist, keeper, harvester, manager |
When analyzing entry points, reject these shortcuts:
If a file cannot be parsed: