entry-point-analyzer

What this skill does

Systematically discovers and classifies all state-changing entry points in smart contracts (Solidity, Rust/Solana, Move), web APIs, and CLI tools. For each entry point the skill records its type, access control, mutability, and payability — then produces a prioritized attack surface summary that feeds directly into vulnerability testing, threat modeling, and compliance reviews.

Entry point types covered:

• External/public functions — callable by any address or user
• Admin-only functions — gated by onlyOwner, roles, or multisig
• Payable functions — accept ETH or native token transfers
• Callback handlers — onERC721Received, uniswapV3SwapCallback, flashLoan receivers, etc.
• Fallback/receive functions — fallback() and receive() in Solidity
• Delegatecall targets — proxy implementations and libraries called via delegatecall
• Web API endpoints — REST mutations, GraphQL mutations, WebSocket message handlers
• CLI sub-commands — sub-commands that mutate state or invoke privileged operations

When to use