defender
starsforks
How to install defender?
quillai-network/quillshield_skills/defender
$npx -y skills add quillai-network/quillshield_skills --skill defenderBlue-team release-gate analysis for smart contract deployment and upgrade readiness. Classifies repositories, checks deploy/upgrade execution paths, CI/CD trust boundaries, config drift, secrets/signer operational security, and outputs evidence-backed release verdicts.
SKILL.md
| 1 | # Defender |
| 2 | |
| 3 | A blue-team release-gate skill for smart contract systems. |
| 4 | |
| 5 | Defender determines whether a repository is safe to deploy or upgrade. It focuses on **release execution risk**, not exploit discovery. |
| 6 | |
| 7 | ## Use when |
| 8 | |
| 9 | - deploying smart contracts |
| 10 | - preparing upgrades |
| 11 | - reviewing deploy scripts |
| 12 | - hardening CI/CD |
| 13 | - rotating admin roles |
| 14 | - validating ownership handoff |
| 15 | - enforcing release hygiene |
| 16 | |
| 17 | ## Non-goals |
| 18 | |
| 19 | Defender does NOT replace: |
| 20 | - full security audits |
| 21 | - economic analysis |
| 22 | - invariant discovery |
| 23 | - deep proxy vulnerability analysis (`proxy-upgrade-safety`) |
| 24 | |
| 25 | It focuses only on **execution safety of release**. |
| 26 | |
| 27 | --- |
| 28 | |
| 29 | ## Core rule |
| 30 | |
| 31 | **Evidence first.** |
| 32 | |
| 33 | Only report findings from: |
| 34 | - contracts |
| 35 | - deploy scripts |
| 36 | - CI workflows |
| 37 | - dependency manifests |
| 38 | - configs / address books |
| 39 | - tests / fork scripts |
| 40 | - docs / runbooks |
| 41 | |
| 42 | Separate: |
| 43 | - **Detection** → what repo proves |
| 44 | - **Policy** → what should be enforced |
| 45 | |
| 46 | --- |
| 47 | |
| 48 | ## Execution order (STRICT) |
| 49 | |
| 50 | 1. Project classification |
| 51 | 2. Defence pass |
| 52 | 3. Severity scoring |
| 53 | 4. Release verdict |
| 54 | |
| 55 | --- |
| 56 | |
| 57 | ## Reference packs |
| 58 | |
| 59 | Always load: |
| 60 | - `references/finding-catalog.md` |
| 61 | - `references/severity-model.md` |
| 62 | - `references/evidence-query-playbook.md` |
| 63 | |
| 64 | Load contextually: |
| 65 | - classification → `project-classification.md` |
| 66 | - CI → `ci-supply-chain.md` |
| 67 | - deploy drift → `config-drift-checks.md` |
| 68 | - upgrade → `upgrade-readiness.md` |
| 69 | - signer → `signer-opsec.md` |
| 70 | - false confidence → `false-confidence.md` |
| 71 | - post-deploy → `post-deploy-validation.md` |
| 72 | |
| 73 | Templates: |
| 74 | - `defender-report-template.md` |
| 75 | - checklist templates as needed |
| 76 | |
| 77 | --- |
| 78 | |
| 79 | # Phase 1 — Project classification |
| 80 | |
| 81 | ### Framework |
| 82 | Detect: |
| 83 | - Foundry / Hardhat / hybrid / other |
| 84 | |
| 85 | Evidence: |
| 86 | - `foundry.toml`, `hardhat.config.*`, scripts |
| 87 | |
| 88 | ### Language |
| 89 | - Solidity / Vyper / Cairo / mixed |
| 90 | |
| 91 | ### Upgradeability |
| 92 | - upgradeable / immutable / mixed |
| 93 | |
| 94 | Evidence: |
| 95 | - OZ upgrade imports |
| 96 | - proxies |
| 97 | - initializer usage |
| 98 | |
| 99 | ### Protocol type |
| 100 | Infer: |
| 101 | - token / vault / AMM / lending / bridge / governance / NFT / staking / other |
| 102 | |
| 103 | ### Deployment surface |
| 104 | - manual / script / CI / multisig / upgrade-task |
| 105 | |
| 106 | ### CI surface |
| 107 | - GitHub Actions / GitLab / other / none |
| 108 | |
| 109 | Output classification block. |
| 110 | |
| 111 | --- |
| 112 | |
| 113 | # Phase 2 — Defence pass |
| 114 | |
| 115 | ## A. Build integrity |
| 116 | |
| 117 | Check: |
| 118 | - compiler version pinned |
| 119 | - optimizer pinned |
| 120 | - evmVersion consistency |
| 121 | - lockfiles committed |
| 122 | - no conflicting configs (Foundry vs Hardhat) |
| 123 | - artifacts reproducible from repo |
| 124 | - verification metadata aligned |
| 125 | |
| 126 | Escalate if: |
| 127 | - build settings differ from verification |
| 128 | - configs produce ambiguous outputs |
| 129 | |
| 130 | --- |
| 131 | |
| 132 | ## B. Dependencies, secrets, supply chain |
| 133 | |
| 134 | Check: |
| 135 | - committed secrets |
| 136 | - `.env` usage for private keys |
| 137 | - floating versions |
| 138 | - unpinned git deps |
| 139 | - install scripts |
| 140 | - dependency confusion risk |
| 141 | - abandoned/suspicious packages |
| 142 | - OZ version mismatch |
| 143 | - unsafe sidecar tooling |
| 144 | - unverified binaries |
| 145 | |
| 146 | ### Secret policy |
| 147 | |
| 148 | Plaintext `.env` private keys are discouraged. |
| 149 | |
| 150 | Preferred: |
| 151 | - **Foundry keystore-backed accounts** |
| 152 | |
| 153 | Classify: |
| 154 | - private key in repo → BLOCKER/HIGH |
| 155 | - deploy scripts using plaintext env keys → HIGH |
| 156 | - `.env` for non-sensitive config → acceptable |
| 157 | |
| 158 | --- |
| 159 | |
| 160 | ## C. CI/CD trust |
| 161 | |
| 162 | Check: |
| 163 | - unpinned GitHub Actions |
| 164 | - secrets in untrusted workflows |
| 165 | - deploys from weak branches |
| 166 | - no approval gate |
| 167 | - excessive secret access |
| 168 | - curl/bash installs |
| 169 | - unsafe runners |
| 170 | - mixed trust zones |
| 171 | |
| 172 | Escalate if CI can deploy unsafely. |
| 173 | |
| 174 | --- |
| 175 | |
| 176 | ## D. Deployment config drift |
| 177 | |
| 178 | CRITICAL |
| 179 | |
| 180 | Check: |
| 181 | - chain ID matches target |
| 182 | - RPC matches chain |
| 183 | - deployer is correct |
| 184 | - constructor/initializer args final |
| 185 | - addresses (oracle/token/admin) valid for chain |
| 186 | - no test/stale addresses |
| 187 | - decimals correct |
| 188 | - verifier settings pinned |
| 189 | - no silent fallback logic |
| 190 | |
| 191 | ### Foundry FFI |
| 192 | |
| 193 | - default: HIGH |
| 194 | - BLOCKER if affecting deploy logic/secrets |
| 195 | |
| 196 | --- |
| 197 | |
| 198 | ## E. Deploy-script safety |
| 199 | |
| 200 | Check: |
| 201 | - chain assertions |
| 202 | - deployer assertions |
| 203 | - env validation |
| 204 | - correct initialization order |
| 205 | - idempotency assumptions clear |
| 206 | - no test config reuse |
| 207 | - address outputs reviewable |
| 208 | - no opaque branching |
| 209 | - verification steps present |
| 210 | |
| 211 | Escalate if scripts can silently misdeploy. |
| 212 | |
| 213 | --- |
| 214 | |
| 215 | ## F. Upgrade readiness (if applicable) |
| 216 | |
| 217 | Check: |
| 218 | - implementation initialized or locked |
| 219 | - initializer calldata reviewed |
| 220 | - storage diff reviewed |
| 221 | - proxy admin correct |
| 222 | - multisig/timelock path exists |
| 223 | - pause/rollback defined |
| 224 | - fork rehearsal exists |
| 225 | |
| 226 | --- |
| 227 | |
| 228 | ## G. Signer & admin opsec |
| 229 | |
| 230 | Check: |
| 231 | - deployer is dedicated |
| 232 | - secure signer preferred |
| 233 | - admin is multisig |
| 234 | - roles separated: |
| 235 | - deployer / upgrader / pauser / treasury |
| 236 | - emergency roles documented |
| 237 | - no hot wallet admin unless justified |
| 238 | - tx review process exists |
| 239 | |
| 240 | --- |
| 241 | |
| 242 | ## H. Address & role mapping |
| 243 | |
| 244 | Extract: |
| 245 | - owner/admin |
| 246 | - proxy admin |
| 247 | - upgrader |
| 248 | - pauser |
| 249 | - treasury |
| 250 | - oracle |
| 251 | - keeper |
| 252 | - timelock |
| 253 | |
| 254 | Flag: |
| 255 | - role concentration |
| 256 | - EOA-onl |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
