skills.rest
Apegurus
ApegurusCOMMUNITY
Explore all skills by this author →
𝕏@ApegurusGitHub

authorization-txorigin

Detect tx.origin authorization checks in Solidity and report remediation steps.

1|1|Updated Feb 18, 2026
Search Tags:#authorization#security#vulnerability#smart contract#solidity#tx.origin
One-click install
npx skills add https://github.com/Apegurus/solidity-argus --skill authorization-txorigin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authorization-txorigin
Source: https://github.com/Apegurus/solidity-argus/tree/main/skills/vulnerability-patterns/authorization-txorigin
Command: npx skills add https://github.com/Apegurus/solidity-argus --skill authorization-txorigin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and helps remediate a critical security vulnerability in smart contracts where the use of tx.origin for authorization can lead to phishing attacks and unauthorized access.

Core Features & Use Cases

  • Vulnerability Detection: Pinpoints the use of tx.origin in authorization logic.
  • Severity Classification: Flags tx.origin usage as a High severity risk.
  • Remediation Guidance: Provides clear instructions to replace tx.origin with msg.sender.
  • Use Case: Automatically scan your Solidity codebase to ensure that no critical functions are protected solely by tx.origin, preventing potential exploits where a user might be tricked into calling a malicious contract that then calls your contract.

Quick Start

Analyze the current Solidity file for tx.origin authorization vulnerabilities.

Frequently Asked Questions about authorization-txorigin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why is using tx.origin for authorization in Solidity a security vulnerability?▼

Using tx.origin for authorization in Solidity exposes contracts to phishing attacks because it records the original transaction sender rather than the immediate caller, allowing malicious contracts to exploit authorized users.

How do I detect tx.origin vulnerabilities in a smart contract?▼

You can detect tx.origin vulnerabilities in a smart contract by scanning the Solidity codebase to pinpoint authorization logic that relies on tx.origin, which flags high severity phishing-prone patterns.

Can I scan my Solidity codebase for tx.origin phishing risks automatically?▼

Yes, you can automatically scan your Solidity codebase to ensure critical functions are not protected solely by tx.origin, identifying phishing-prone patterns and providing remediation steps.

What is the difference between tx.origin and msg.sender for smart contract security?▼

For smart contract security, tx.origin returns the original external account that started the transaction, while msg.sender returns the immediate caller, making msg.sender the secure choice for authorization checks.

When should I not use tx.origin in Solidity?▼

You should not use tx.origin in Solidity for authorization checks because it creates phishing risks if a user interacts with a malicious contract that subsequently calls your contract.

Related Skills

Explore More Software Engineering Skills→
sabyunreposabyunrepo

Code Manager Skill

Clone GitHub repositories and analyze Python code with AST to extract design patterns.

Community
Advanced
protofireprotofire
3

protofire-qa-agent

Audit smart contracts with Slither, Echidna, and Foundry fuzz testing.

Official
Advanced
zzw4257zzw4257

Semgrep

Runs static code analysis with customizable rulesets to detect security vulnerabilities across multiple languages.

Community
Intermediate
hypnguyen1209hypnguyen1209
338

initial-access

Plan initial-access techniques for offensive security engagements.

Community
Advanced