entry-point-analyzer

Identifies state-changing entry points in smart contract codebases and classifies them by access level.

Updated Mar 22, 2026
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill entry-point-analyzer-tech-hy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: entry-point-analyzer
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/entry-point-analyzer
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill entry-point-analyzer-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security auditors need a complete map of a smart contract's attack surface before deep review, but manually finding every externally callable, state-changing function across large multi-language codebases is slow and error-prone. ## Core Features & Use Cases - Multi-Language Entry Point Detection: Extracts state-changing external functions from Solidity, Vyper, Solana/Rust, Move (Sui/Aptos), TON (FunC/Tact), and CosmWasm contracts while excluding view/pure read-only functions. - Access Control Classification: Categorizes each entry point as Public, Role-Restricted (admin, owner, governance, guardian, etc.), Restricted (review required), or Contract-Only (callbacks and CPI patterns). - Slither Integration: Automatically uses Slither's entry-points printer for Solidity codebases when available, falling back to manual analysis otherwise. - Use Case: Before auditing a DeFi lending protocol, run this skill to produce a structured markdown report listing every state-changing function, its access restrictions, and file locations, so you can prioritize high-risk privileged operations. ## Quick Start Analyze this smart contract repository and generate a report of all state-changing entry points classified by access level.

Frequently Asked Questions about entry-point-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find all entry points in a Solidity smart contract?

Extract all external and public functions while excluding those marked view or pure, then classify each by its access control modifiers like onlyOwner or onlyRole. If Slither is installed, running slither with the entry-points printer automates this extraction.

What smart contract languages are supported for entry point analysis?

The analysis supports Solidity, Vyper, Solana (Rust with Anchor or native), Move on Sui and Aptos, TON (FunC and Tact), and CosmWasm. Each language has dedicated detection rules for its visibility and access control patterns.

Does entry point analysis include view and pure functions?

No, read-only functions such as Solidity view and pure functions, Vyper @view functions, and CosmWasm query handlers are excluded. They cannot directly modify state or cause loss of funds, so the focus stays on state-changing functions.

How is access control classified for smart contract functions?

Functions are grouped into Public (unrestricted), Role-Restricted (admin, owner, governance, guardian, and similar roles), Restricted requiring manual review for ambiguous patterns, and Contract-Only for callbacks and cross-contract hooks.

What happens if Slither is not installed for Solidity analysis?

The workflow checks for Slither availability first and falls back to manual analysis using the Solidity reference rules if it is missing or fails due to compilation errors. Manual review also supplements Slither output for callbacks and dynamic access control it may miss.

When should I not use entry point analysis?

Do not use it for vulnerability detection, exploit proof-of-concept writing, gas optimization, or code quality review. It only maps the attack surface; deeper vulnerability analysis requires dedicated audit skills, and it does not apply to non-smart-contract codebases.