example-fork-detection
TEMPLATE — replace with the description of your rule. Should activate on the specific code patterns your fork has. Activate on…
@omermaksutiiInstall SkillSecurity
Skill
/progress-and-streaming
Convention for streaming progress on long-running audit commands. Use during /audit, /audit-deep, /audit-strict, /simulate, /exploit-chain — anything taking >10 seconds.
Claude Code
$ npx -y skills add omermaksutii/RugProof --skill progress-and-streaming --agent claude-code
Codex
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a codex -y
Cursor
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a cursor -y
Gemini CLI
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a gemini-cli -y
GitHub Copilot
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a github-copilot -y
OpenCode
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a opencode -y
Windsurf
$ npx skills add omermaksutii/RugProof --skill progress-and-streaming -a windsurf -y
SKILL.md
progress-and-streaming.SKILL.mdname: progress-and-streaming
description: Convention for streaming progress on long-running audit commands. Use during /audit, /audit-deep, /audit-strict, /simulate, /exploit-chain — anything taking >10 seconds.
Progress & streaming (meta-skill)
Long audits with no output feel broken. This skill defines the contract for live updates.
When to stream
- Any command expected to take >10 seconds.
- Any command that dispatches multiple subagents in parallel.
- Any command that reads many files (>5).
What to emit
Stream short status lines to stdout as work progresses. Each line should be self-contained — a user reading the third line shouldn't need the first two.
Stages
[1/5] Inventory scanning src/ for Solidity files
[1/5] Inventory found 12 files (3,456 LoC), Solidity 0.8.24
[2/5] Skills running reentrancy, access-control, oracle-manipulation, …
[2/5] Skills 18 skill checks complete (847ms)
[3/5] Specialists dispatching: amm-specialist, attacker, defender (parallel)
[3/5] Specialists amm-specialist: 3 findings
[3/5] Specialists attacker: 5 findings (1 chain candidate)
[3/5] Specialists defender: 2 missing-defense notes
[4/5] Consolidate dedup + severity assignment
[5/5] Report 12 findings, grade C → wrote rugproof-reports/audit-2026-05-13.md
Format
- `[N/M] STAGE message` — N is current stage, M is total
- Stage name padded to 12 chars for alignment
- Message in lowercase, terse, no "I am now ..." prose
- Numbers preferred over adjectives ("847ms" beats "quickly")
Don't
- No spinners or animations (terminal output, not UI).
- No ANSI colors unless `process.stdout.isTTY` AND user hasn't disabled.
- No hidden state — every meaningful event gets a line.
Cancellation
If the user interrupts (Ctrl+C / Esc), emit:
[!] cancelled at stage [3/5]: dispatched specialists are still running, partial results saved to .rugproof/partial/
Implementation note
In a Claude Code slash-command context, this means: emit short text messages between tool calls. The user sees them streamed. Don't batch all updates into a final block.
Related
- [[caching-and-incremental]] — show cache stats in stage [1/5]
- [[confidence-scoring]] — show per-skill confidence as findings come in
Read more
name: progress-and-streaming description: Convention for streaming progress on long-running audit commands. Use during /audit, /audit-deep, /audit-strict, /simulate, /exploit-chain — anything taking >10 seconds.
Progress & streaming (meta-skill)
Long audits with no output feel broken. This skill defines the contract for live updates.
When to stream
- Any command expected to take >10 seconds.
- Any command that dispatches multiple subagents in parallel.
- Any command that reads many files (>5).
What to emit
Stream short status lines to stdout as work progresses. Each line should be self-contained — a user reading the third line shouldn't need the first two.
Stages
[1/5] Inventory scanning src/ for Solidity files [1/5] Inventory found 12 files (3,456 LoC), Solidity 0.8.24 [2/5] Skills running reentrancy, access-control, oracle-manipulation, … [2/5] Skills 18 skill checks complete (847ms) [3/5] Specialists dispatching: amm-specialist, attacker, defender (parallel) [3/5] Specialists amm-specialist: 3 findings [3/5] Specialists attacker: 5 findings (1 chain candidate) [3/5] Specialists defender: 2 missing-defense notes [4/5] Consolidate dedup + severity assignment [5/5] Report 12 findings, grade C → wrote rugproof-reports/audit-2026-05-13.md
Format
- `[N/M] STAGE message` — N is current stage, M is total
- Stage name padded to 12 chars for alignment
- Message in lowercase, terse, no "I am now ..." prose
- Numbers preferred over adjectives ("847ms" beats "quickly")
Don't
- No spinners or animations (terminal output, not UI).
- No ANSI colors unless `process.stdout.isTTY` AND user hasn't disabled.
- No hidden state — every meaningful event gets a line.
Cancellation
If the user interrupts (Ctrl+C / Esc), emit:
[!] cancelled at stage [3/5]: dispatched specialists are still running, partial results saved to .rugproof/partial/
Implementation note
In a Claude Code slash-command context, this means: emit short text messages between tool calls. The user sees them streamed. Don't batch all updates into a final block.
Related
- [[caching-and-incremental]] — show cache stats in stage [1/5]
- [[confidence-scoring]] — show per-skill confidence as findings come in
Stats
11
Stars
0
Forks
Maintained
Maintenance
JavaScript
Language
MIT
License
Last commit
Created
Ships withrugproof
Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy
1052 skills23 agents
Stars on GitHub
Momentum
- stars in total
- 10
Other skills on rugproof.
@omermaksutiiInstall Skillsolady-erc20-permit2-a…
Detect unsafe assumptions about Solady's gas-optimized ERC20/ERC2612 permit and DN404 metadata. Solady's ERC20 uses custom…
@omermaksutiiInstall Skillsolady-ownable-init-fr…
Detect front-runnable ownership initialization in Solady Ownable / OwnableRoles. Solady's `_initializeOwner` is a guarded…
@omermaksutiiInstall Skillsolady-safetransferlib…
Detect Solady SafeTransferLib calls that assume the token has code. SafeTransferLib.safeTransfer/safeTransferFrom/safeApprove…
@omermaksutiiInstall Skillv4-hook-delta-accounti…
Detect Uniswap V4 hooks that fail to settle currency deltas with the PoolManager. Every credit/debit a hook creates…
@omermaksutiiInstall Skillv4-hook-permission-fla…
Detect Uniswap V4 hooks whose address-encoded permission flags don't match the callbacks the hook actually implements. In V4 the…
@omermaksutiiInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about progress-and-streaming.
- Which coding agents can use progress-and-streaming?
- progress-and-streaming installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.