Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub · Security & Compliance
Solidity
Avoid common Solidity mistakes — reentrancy, gas traps, storage collisions, and security pitfalls.
skill openclawclawhub Free
Avoid common Solidity mistakes — reentrancy, gas traps, storage collisions, and security pitfalls.
⬇ 0 downloads ★ 0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- SKILL.md
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.0.0
Provenance
- Publisher
- ivangdavila
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Reentrancy
External calls before state updates — attacker can re-enter before state changes Checks-Effects-Interactions pattern — validate, update state, THEN external call ReentrancyGuard from OpenZeppelin — use nonReentrant modifier on vulnerable functions transfer() and send() have 2300 gas limit — but don't rely on this for security
Integer Handling
Solidity 0.8+ reverts on overflow — but unchecked {} blocks bypass this Division truncates toward zero — 5 / 2 = 2, no decimals Use fixed-point math for precision — multiply before divide, or use libraries type(uint256).max for max value — don't hardcode large numbers
Gas Gotchas
Unbounded loops can exceed block gas limit — paginate or limit iterations Storage writes cost 20k gas — memory/calldata much cheaper delete refunds gas but has limits — refund capped, don't rely on it Reading storage in loop — cache in memory variable first
Visibility and Access
State variables default to internal — not private, derived contracts see them private doesn't mean hidden — all blockchain data is public, just not accessible from other contracts tx.origin is original sender — use msg.sender, tx.origin enables phishing attacks external can't be called internally — use public or this.func() (wastes gas)
Ether Handling
payable required to receive ether — non-payable functions reject ether selfdestruct sends ether bypassing fallback — contract can receive ether without receive function Check return value of send() — returns false on failure, doesn't revert call{value: x}("") preferred over transfer() — forward all gas, check return value
Storage vs Memory
storage persists, memory is temporary — storage costs gas, memory doesn't persist Structs/arrays parameter default to memory — explicit storage to modify state calldata for external function inputs — read-only, cheaper than memory Storage layout matters for upgrades — never reorder or remove storage variables
Upgradeable Contracts
Constructors don't run in proxies — use initialize() with initializer modifier Storage collision between proxy and impl — use EIP-1967 storage slots Never selfdestruct implementation — breaks all proxies pointing to it delegatecall uses caller's storage — impl contract storage layout must match proxy
Common Mistakes
Block timestamp can be manipulated slightly — don't use for randomness or precise timing require for user errors, assert for invariants — assert failures indicate bugs String comparison with == doesn't work — use keccak256(abi.encodePacked(a)) == keccak256(abi.encodePacked(b)) Events not indexed — first 3 params can be indexed for efficient filtering
Category context
Identity, auth, scanning, governance, audit, and operational guardrails.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
1 Docs
- SKILL.md