entry-point-analyzer

An agent skill by trailofbits, from trailofbits/skills. Tags: access-control, analysis, architecture, security, smart-contracts.

What it does

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill entry-point-analyzer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/entry-point-analyzer/skills/entry-point-analyzer ~/.claude/skills/entry-point-analyzer

Safety box score

Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a smart-contract analysis helper: it reads source files, optionally runs local analysis (`slither`), and produces an entry-point report. It does not include destructive actions, network exfiltration, or privilege escalation, but it does execute local tooling against the workspace and inspects whatever contract files are present.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It can run local analysis commands via the shell, including `which slither` and `slither . --print entry-points`, but only for code inspection.
Network access	0 (none)	No network fetches, uploads, or remote calls are defined; the workflow is limited to local file reading and optional local tooling.
Filesystem reach	1 (low)	It reads repository files and bundled references to analyze contracts, but the documented workflow is confined to the workspace and report output.
Secrets & credentials	0 (none)	There is no instruction to access tokens, keychains, `.env` files, browser sessions, or other secret stores.
Privilege & persistence	0 (none)	The only privileged term is CosmWasm `sudo` in the documentation, which refers to a contract entry point, not OS/root privilege; no sudo/install-global/system-setting actions are present.
Instruction hijack surface	0 (none)	The files do not instruct the agent to ignore higher-priority rules, hide actions, or follow remote instructions; the content is scoped analysis guidance.
Irreversible actions	0 (none)	The skill only maps and reports entry points; it does not send messages, deploy, publish, pay, or modify external systems.
Transparency	0 (none)	All shipped files are plain text/SVG and readable; there are no binaries, packed blobs, or runtime-decoded payloads.

Before installing

Review `SKILL.md` for the optional `slither . --print entry-points` step if you prefer not to run local tooling.
Confirm the repository scope is limited to contract source; the skill will read all analyzable files in that scope.
If your workspace contains sensitive artifacts, move them out of scope before using the analyzer.
Treat the CosmWasm `sudo` references as contract concepts only; no OS/admin privileges are required.

Rated 2026-10-18 by an automated review of 10 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/entry-point-analyzer/skills/entry-point-analyzer/SKILL.md
Branch: main
Collection: entry-point-analyzer
Updated: 2026-09-19

algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.