# Sol Desk

> The pre-deployment desk for one Solidity contract. Paste the source you are about to deploy and run
> one of five jobs over it: classify its protocol shape against the canonical implementation, audit it
> for security, model its economic attack surface, check the ERC standard it claims member by member,
> or generate the Foundry suite that guards it.

Live at https://sol-desk.skillsafe.ai/

## What it is

A browser app. One work object — a Solidity source file — and five lanes over it. A deterministic
Solidity reader runs entirely client-side before anything is sent anywhere; the model lanes are
metered and require a signed-in SkillSafe account.

**Sol Desk is not an audit.** It does not compile, deploy, fork, simulate or fuzz anything. It reads
the source it is given. The prompt forbids it from describing any contract as safe, secure or audited,
and the strongest posture it can return is `deployable`, meaning "no blocking issue was visible in
this source".

## The free half: an in-browser Solidity reader

No account, no charge, nothing leaves the page. It lexes the source (removing comments and string
literals while preserving offsets), carves it into contracts and functions with a brace matcher, and
reports:

- the pragma, the SPDX identifier and every import
- every contract, interface, library and abstract contract, with its inheritance list
- every function with its visibility, state mutability and modifier list
- every state variable, including `public` ones whose implicit getters satisfy a token standard
- events, custom errors and modifiers
- the detected token standard (ERC-20, ERC-721, ERC-1155, ERC-4626) by interface match and by
  inheritance, with the match count
- the detected protocol kind (AMM, lending, vault, staking, governance, bridge, auction, vesting,
  token, NFT, utility) with the distinct markers that led to it and the runners-up

and then runs a rule set that flags, each with a severity, a line number and a verbatim quote:
checks-effects-interactions violations, low-level calls and discarded return values, discarded ERC-20
booleans, `tx.origin` authorization, block-value randomness, `delegatecall`, `selfdestruct`, inline
assembly, `unchecked` blocks, narrowing integer casts, unauthenticated state-changing entry points,
missing zero-address checks on stored addresses, silent state changes, unbounded loops, spot-price and
read-only oracle surfaces, missing slippage and deadline parameters, fee-on-transfer assumptions,
empty-pool share minting, trapped ether, one-step ownership transfers, upgradeable contracts that
never disable initializers or reserve a storage gap, missing ERC members, missing ERC-165, and gas
observations.

Every flag is sent with the run, and the model must return exactly one reconciliation entry per flag —
`confirmed`, `set-aside` or `superseded` — so anything it fails to account for is visible in the UI
rather than quietly dropped. The reader is regex-grade and the prompt tells the model it is expected
to overrule it; `set-aside` with a concrete reason is a first-class outcome.

## The five lanes

| `task` | What it returns |
| --- | --- |
| `pattern` | The protocol kind with quoted evidence, a reference outline of what a production implementation of that kind carries, a component-by-component present/partial/absent comparison, and the deliberate deviations. |
| `audit` | Fourteen named security checks (SEC-1..SEC-14), severity-ranked findings with verbatim evidence and a compilable fix, severity counts, and an ordered exploit path for each critical and high. |
| `defi` | Ten named economic attack vectors (DFI-1..DFI-10) each marked applicable yes/no/unclear with preconditions, mechanism, impact and mitigation; the economic invariants that must hold; and the value flows. |
| `standards` | The detected standard with evidence, every mandatory interface member present/absent/wrong-signature, the behaviour rules where conformance actually breaks, and the optional extensions. |
| `tests` | A Foundry test plan — unit, negative, fuzz, invariant and fork cases — plus the complete `.t.sol` file as an artifact, with a negative case for every critical and high finding carried in from a previous lane. |

Lanes hand off: an `audit` or `defi` result carries its findings into `tests` with one button, and the
test plan must cover each of them.

## Input contract

`POST https://api.skillsafe.ai/v1/app-api/run` (or `/run-stream`). The body IS the input object.

```json
{
  "task": "audit",
  "contract": "// SPDX-License-Identifier: MIT\npragma solidity ^0.8.24;\ncontract C { }",
  "notes": "optional free-text context",
  "prescan": {"inventory": {}, "flags": []},
  "prior_findings": []
}
```

Several files may be concatenated with `// file: path/Name.sol` marker lines and are treated as one
compilation unit.

## Output contract

One JSON object. Common envelope on every lane: `lane`, `lane_inferred`, `contract_name`, `title`,
`posture` (`deployable` / `fix-first` / `blocked`), `verdict`, `solidity_pragma`, `protocol_kind`,
`summary`, `assumptions`, `open_questions`, `findings`, `coverage_check`, `artifact`, `next_lane`,
`body`. The `body` object is the only per-lane part.

Findings carry `id`, `title`, `severity` (`critical` / `high` / `medium` / `low` / `info`), `area`,
`symbol`, `line`, `why`, `evidence` (a verbatim slice of the pasted source), `fix` and `confidence`.

Full documentation, with worked examples in cURL, Python, JavaScript, Go, Java, Ruby, PHP and C#:
https://sol-desk.skillsafe.ai/api.html

## Export

Copy-all as Markdown, `.md` and `.json` downloads, findings as CSV, a pull-request comment, GitHub
Actions CI annotations, and the generated `.t.sol` file.

## Sources

Sol Desk is a derived work built on five published agent skills. It is not affiliated with, endorsed
by, or maintained by their authors.

- `@wshobson/solidity-security` — smart contract security practice, vulnerability prevention
- `@wshobson/defi-protocol-templates` — canonical DeFi protocol shapes
- `@wshobson/nft-standards` — token standard conformance
- `@wshobson/web3-testing` — Hardhat and Foundry testing strategy
  (the four above from `wshobson/agents`)
- `@affaan-m/defi-amm-security` — AMM, liquidity pool and swap-flow security checklist, from
  `affaan-m/everything-claude-code`

## Limits worth knowing

- It reads only what you paste. A contract that inherits from an unpasted base is reviewed on what is
  visible, and the standards lane marks such behaviour `unverifiable` rather than guessing.
- It never claims to have run anything. Test cases are written as "this test asserts", never "this
  test passes". Gas figures are given as orders of magnitude with a reason, never as measurements.
- No token prices, no yields, no market predictions, no investment advice.
- A clean result is not an audit and should never be presented as one.