Skip to content
appsgit

Web3 Bug Classes

Web3 Bug Classes is an agent skill (a SKILL.md file) from tradecatlabs/vibe-coding-cn. Complete reference for all 10 DeFi smart contract bug classes. It works with Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode and has 17,171 GitHub stars across a repository of 5 listed skills.

github.com/tradecatlabs/vibe-coding-cn/research/vibe-cybersecurity-cn/skills/web3-bug-bounty-hunting/web3-bug-classes (opens in a new tab)

  • Multi-skill repo
  • Needs API key
  • Testing & QA
  • Actively maintained
View on GitHub (opens in a new tab)

Add this skill

Claude

Claude Code loads skills from ~/.claude/skills/ (all projects) or .claude/skills/ (one project):

git clone --depth 1 https://github.com/tradecatlabs/vibe-coding-cn.git
cp -r vibe-coding-cn/research/vibe-cybersecurity-cn/skills/web3-bug-bounty-hunting/web3-bug-classes ~/.claude/skills/web3-bug-classes   # personal, or .claude/skills in a project

In the Claude apps, zip the web3-bug-classes folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).

ChatGPT / Codex

Codex reads skills from .agents/skills/ in a repo or ~/.agents/skills/ for every project:

git clone --depth 1 https://github.com/tradecatlabs/vibe-coding-cn.git
cp -r vibe-coding-cn/research/vibe-cybersecurity-cn/skills/web3-bug-bounty-hunting/web3-bug-classes .agents/skills/web3-bug-classes   # repo; ~/.agents/skills for all projects

Standalone skills also load in the ChatGPT desktop app.

Cursor

Cursor loads skills from .cursor/skills/ (or ~/.cursor/skills/) and also reads .claude/skills/:

git clone --depth 1 https://github.com/tradecatlabs/vibe-coding-cn.git
cp -r vibe-coding-cn/research/vibe-cybersecurity-cn/skills/web3-bug-bounty-hunting/web3-bug-classes .cursor/skills/web3-bug-classes   # project; ~/.cursor/skills for all projects

Source (checked Oct 7, 2026): code.claude.com/docs/en/skills (opens in a new tab), support.claude.com/en/articles/12512180-using-skills-in-claude (opens in a new tab), learn.chatgpt.com/docs/build-skills (opens in a new tab), cursor.com/docs/context/skills (opens in a new tab)

What this skill does

Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs. 10 bug classes. Each one with root cause, vulnerable code, fix, grep patterns, and real paid examples.

When it triggers

  • Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrad

More skills in tradecatlabs/vibe-coding-cn

5 skills are listed from this repository.

Similar skills

More testing & qa skills

All Testing & QA

FAQ

Web3 Bug Classes FAQ

Still curious? Email info@appsgit.com.

What is the Web3 Bug Classes skill?

Web3 Bug Classes is an agent skill (a SKILL.md file) from tradecatlabs/vibe-coding-cn. Complete reference for all 10 DeFi smart contract bug classes. It works with Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode and has 17,171 GitHub stars across a repository of 5 listed skills. Its SKILL.md lives at github.com/tradecatlabs/vibe-coding-cn/research/vibe-cybersecurity-cn/skills/web3-bug-bounty-hunting/web3-bug-classes.

How do I install the Web3 Bug Classes skill?

Copy the web3-bug-classes folder (the one containing SKILL.md) into ~/.claude/skills/ for Claude Code, .agents/skills/ for Codex or .cursor/skills/ for Cursor. The agent picks it up automatically when a task matches its description.

Is the Web3 Bug Classes skill free?

Yes. The repository is open source under the MIT license. The skill mentions an API key or token for an external service, which may need its own account.

Is Web3 Bug Classes maintained?

The repository's most recent commit was on Oct 1, 2026. appsgit only lists skills from repositories with a commit in the last six months.