Prescriptive orchestrators for authoring/testing/optimization + unified UX#44
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughAdds and rewrites documentation and SKILL definitions for cairo-contract-authoring, cairo-testing, and cairo-optimization; restructures their default workflows into phased multi‑turn processes; updates root README; adds eval cases enforcing owner-guarding for Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
Greptile SummaryThis PR applies the prescriptive orchestrator pattern to Many issues raised in prior review rounds have been addressed in this iteration:
Remaining issues:
Confidence Score: 3/5
|
| Filename | Overview |
|---|---|
| cairo-optimization/scripts/profile.py | New _step_export_summary_text function adds machine-readable .summary.txt export; uses correct exit code 7 and 600 s timeout, but an unhandled OSError on the file write bypasses the documented exit-code contract. |
| evals/cases/contract_skill_generation_eval.jsonl | New gen_owned_external_v0_guarded_mutator case adds split_half coverage (previously missing) but both must_not_match entries reproduce the [^}]{0,320}? nested-brace fragility that causes false-positive passes for insecure generated code with nested blocks. |
| evals/cases/contract_skill_benchmark.jsonl | Two new #[external(v0)] auth cases added; both reference the existing secure_owned_vault / insecure_owned_vault fixtures; io_auth_external_v0_set_fee_guarded uses an ambiguous must_match pattern on an insecure fixture (previously flagged). |
| cairo-optimization/SKILL.md | Rewritten to prescriptive 4-turn orchestrator; {skill_dir} glob fragility resolved; SHIFT pattern now defined inline; missing ## Eval Gate section despite adding new BoundedInt/StorePacking rules in v1.3.0. |
| cairo-contract-authoring/SKILL.md | Prescriptive 4-turn orchestrator; covers both #[abi(embed_v0)] and #[external(v0)]; Eval Gate section present; allowed-tools and metadata retained; previously flagged issues substantially addressed. |
| cairo-testing/SKILL.md | New skill with 4-turn orchestrator; Turn 1 and Turn 3 now explicitly include both #[abi(embed_v0)] and #[external(v0)] functions; Eval Gate section present; {skill_dir} resolution updated to preferred SKILL path approach. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[User Request] --> B{Skill Router}
B --> C[cairo-contract-authoring]
B --> D[cairo-testing]
B --> E[cairo-optimization]
B --> F[cairo-auditor]
C --> C1[Turn 1: Understand\nClassify mode: new/modify/component\nLoad references]
C1 --> C2[Turn 2: Plan\nInterface + Storage + Security posture\nWait for confirmation]
C2 --> C3[Turn 3: Implement\nscarb build\nSecurity rules enforced]
C3 --> C4[Turn 4: Verify\nCheck every external fn\nSuggest testing + audit]
C4 --> C5[Phase 5: Handoff & Eval Lock\nDistill to evals/cases/]
D --> D1[Turn 1: Understand\nClassify test mode\nRead contract + find external fns]
D1 --> D2[Turn 2: Plan\nMap fns to test types\nWait for confirmation]
D2 --> D3[Turn 3: Implement\nsnforge test\nCoverage rules enforced]
D3 --> D4[Turn 4: Verify\nCoverage checklist\nReport gaps]
D4 --> D5[Phase 5: Handoff\nFeed patterns to evals/cases/]
E --> E1[Turn 1: Baseline\nsnforge test + profile.py\nRead summary.txt hotspots]
E1 --> E2[Turn 2: Plan\nMatch hotspots to rules\nWait for confirmation]
E2 --> E3[Turn 3: Optimize\nOne class per commit\nRe-test + Re-profile]
E3 --> E4[Turn 4: Verify\nBefore/after deltas\nUpdate evals/cases/]
E4 --> E5[Phase 5: Lock\ncairo-auditor check\nEval benchmark update]
C4 -.->|suggest| D
D4 -.->|suggest| F
D4 -.->|suggest| E
E4 -.->|suggest| F
Comments Outside Diff (1)
-
cairo-optimization/SKILL.md, line 147 (link)Missing
## Eval Gatesection — contributor reminder absent for new optimization rulescairo-contract-authoring/SKILL.md(lines 132–138) andcairo-testing/SKILL.md(lines 150–155) both have an explicit## Eval Gatesection reminding contributors to update eval cases whenever security or detection rules change. This file bumps the version to1.3.0and adds new BoundedInt, SHIFT-pattern, and StorePacking rules that affect detection quality, but has no## Eval Gatesection.Without this reminder, a future contributor updating Turn 3's optimization rules has no in-file prompt to add a matching
evals/cases/entry — reproducing the gap that required a previous review pass to surface.Consider adding at the end of the file:
## Eval Gate When optimization rules in this skill or its references change, update at least one case in: - `evals/cases/contract_skill_benchmark.jsonl` - `evals/cases/contract_skill_generation_eval.jsonl`
Prompt To Fix With AI
This is a comment left during a code review. Path: cairo-optimization/SKILL.md Line: 147 Comment: **Missing `## Eval Gate` section — contributor reminder absent for new optimization rules** `cairo-contract-authoring/SKILL.md` (lines 132–138) and `cairo-testing/SKILL.md` (lines 150–155) both have an explicit `## Eval Gate` section reminding contributors to update eval cases whenever security or detection rules change. This file bumps the version to `1.3.0` and adds new BoundedInt, SHIFT-pattern, and StorePacking rules that affect detection quality, but has no `## Eval Gate` section. Without this reminder, a future contributor updating Turn 3's optimization rules has no in-file prompt to add a matching `evals/cases/` entry — reproducing the gap that required a previous review pass to surface. Consider adding at the end of the file: ```markdown ## Eval Gate When optimization rules in this skill or its references change, update at least one case in: - `evals/cases/contract_skill_benchmark.jsonl` - `evals/cases/contract_skill_generation_eval.jsonl` ``` How can I resolve this? If you propose a fix, please make it concise.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix All With AI
This is a comment left during a code review.
Path: cairo-optimization/scripts/profile.py
Line: 280-281
Comment:
**Unhandled `OSError` on file write bypasses documented exit codes**
`open()` and `handle.write()` can raise `OSError`/`IOError` (e.g., permission denied, disk full). When this happens the exception propagates unhandled all the way out of `main()`, and Python exits with a traceback and a non-deterministic exit code (typically `1`). Any CI script that inspects `$?` to distinguish failure reasons will misinterpret a disk-full error as an argument error (exit code `1`), breaking the documented exit-code contract for exit codes `5`–`7`.
Wrap the write in a try/except:
```suggestion
try:
with open(summary_path, "w", encoding="utf-8") as handle:
handle.write(result.stdout)
except OSError as exc:
_fail(7, f"Failed to write hotspot summary to {summary_path}: {exc}")
```
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: evals/cases/contract_skill_generation_eval.jsonl
Line: 13
Comment:
**`split_half` `must_not_match` reproduces the same `[^}]` nested-brace fragility as `set_fee`**
The newly-added `split_half` `must_not_match` entry uses `[^}]{0,320}?self\.[a-zA-Z_][a-zA-Z0-9_]*\.write`, which stops matching at the first `}` encountered — identical to the `set_fee` pattern's known fragility. If a generated `split_half` contains any nested block before the storage write (e.g., a bounds guard or an `if` expression), the `[^}]` class stops there and the pattern never reaches `.write`, so the eval case would silently pass even for insecure code.
Example that evades detection:
```cairo
#[external(v0)]
fn split_half(ref self: ContractState, amount: u128) {
if amount > 0 { // ← `}` here ends [^}] scan
self.balance.write(amount); // write-before-guard goes undetected
}
assert_only_owner(@self);
}
```
Apply the same multiline-capable fix suggested for `set_fee` (e.g., replace `[^}]{0,320}?` with a lookahead or split into two patterns) to both entries in this case.
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: cairo-optimization/SKILL.md
Line: 147
Comment:
**Missing `## Eval Gate` section — contributor reminder absent for new optimization rules**
`cairo-contract-authoring/SKILL.md` (lines 132–138) and `cairo-testing/SKILL.md` (lines 150–155) both have an explicit `## Eval Gate` section reminding contributors to update eval cases whenever security or detection rules change. This file bumps the version to `1.3.0` and adds new BoundedInt, SHIFT-pattern, and StorePacking rules that affect detection quality, but has no `## Eval Gate` section.
Without this reminder, a future contributor updating Turn 3's optimization rules has no in-file prompt to add a matching `evals/cases/` entry — reproducing the gap that required a previous review pass to surface.
Consider adding at the end of the file:
```markdown
## Eval Gate
When optimization rules in this skill or its references change, update at least one case in:
- `evals/cases/contract_skill_benchmark.jsonl`
- `evals/cases/contract_skill_generation_eval.jsonl`
```
How can I resolve this? If you propose a fix, please make it concise.Last reviewed commit: 52afe6b
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-contract-authoring/README.md`:
- Around line 59-61: The fenced code block containing "cairo-contract-authoring
→ cairo-testing → cairo-auditor" should include a language specifier for proper
rendering; update the README.md fenced block (the triple-backtick block that
wraps that arrow flow) to use a language tag such as text (i.e., change ``` to
```text) so the flow diagram renders correctly.
- Around line 33-42: Reorder the bullet list under the "Security rules (always
enforced)" heading to match the SKILL.md sequence: put "Timelock checks read
from `get_block_timestamp()`, never from caller arguments" first, then "Every
storage-mutating external function has explicit access posture: **guarded**
...", then "Upgrade flows reject zero class hash", then "Constructor validates
all critical addresses are non-zero", and keep "Anti-pattern/secure-pattern
pairs are enforced — the anti-pattern is never written" last; update the
README.md bullets accordingly so both files use the same ordering for easier
cross-referencing.
- Around line 45-55: The fenced code block showing the directory tree (starting
with the line "cairo-contract-authoring/" and containing entries like "SKILL.md"
and "references/") lacks a language specifier; update the README.md code fence
to include a language token (e.g., "text") right after the opening backticks so
the block is rendered correctly (change ``` to ```text) for that directory
structure snippet.
In `@cairo-contract-authoring/workflows/default.md`:
- Around line 37-42: In Phase 5 — Handoff update the example Python command to
make the repo-root placeholder explicit (use angle brackets) so readers know to
replace it; specifically, change the command shown (`python3
scripts/quality/audit_local_repo.py --repo-root /path/to/repo --scan-id
handoff-audit`) to use a clearer placeholder like `--repo-root <project-root>`
and keep the rest of the arguments intact so it's obvious where to substitute
their repository path.
- Around line 11-18: Phase 2's design checklist is missing the "Events" output;
update the Phase 2 — Design list to include an "Output events plan: emitted
events, event parameters, when to emit (on success/failure), and indexing
requirements" item so it matches SKILL.md Turn 2's five components (Interface,
Storage, Components, Events, Security posture) and waits for user confirmation
before implementing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: f5c04c91-c108-40fc-9100-256ffae10d38
📒 Files selected for processing (3)
cairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: full-evals
- GitHub Check: Greptile Review
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-contract-authoring/README.md
🪛 LanguageTool
cairo-contract-authoring/SKILL.md
[style] ~44-~44: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~116-~116: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
cairo-contract-authoring/workflows/default.md
[style] ~15-~15: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ut storage plan: fields, types, maps. - Output component plan: which OZ components, wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~16-~16: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...hich OZ components, wiring checklist. - Output security posture: for each external fun...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.21.0)
cairo-contract-authoring/README.md
[warning] 45-45: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 59-59: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (17)
cairo-contract-authoring/README.md (2)
1-23: LGTM! Clear introduction and practical usage examples.The introduction effectively communicates the tool's purpose, target audience, and value proposition. The usage examples demonstrate both general and specific invocation patterns that align with the modes described in SKILL.md.
24-32: LGTM! Workflow summary aligns with SKILL.md orchestration.The 4-turn workflow accurately summarizes the detailed orchestration defined in SKILL.md (lines 48-109), including the user confirmation checkpoint before implementation.
cairo-contract-authoring/workflows/default.md (4)
3-3: LGTM! Clear orchestration reference.The note correctly establishes SKILL.md as the canonical orchestrator and clarifies this file's role as the phase reference guide. Based on learnings, referring to SKILL.md as the canonical router aligns with project guidelines.
5-10: LGTM! Phase 1 aligns with SKILL.md Turn 1.The mode classification (new/modify/component) correctly matches the orchestration defined in SKILL.md (lines 40-44, 50).
19-30: LGTM! Phase 3 aligns with SKILL.md Turn 3.The implementation guidelines appropriately provide high-level principles while SKILL.md (lines 75-98) provides the detailed prescriptive rules. The
scarb buildverification requirement matches exactly.
31-36: LGTM! Phase 4 perfectly aligns with SKILL.md Turn 4.The verification steps match SKILL.md lines 100-109 exactly: re-check security rules, run tests if they exist, and suggest next steps for testing and auditing.
cairo-contract-authoring/SKILL.md (11)
1-9: LGTM! Clear skill definition and role statement.The updated description effectively communicates trigger phrases and capabilities, while the role statement clearly defines the assistant's responsibilities across the 4-turn workflow.
10-24: LGTM! Clear skill boundaries and appropriate delegation.The "When to Use" and "When NOT to Use" sections effectively define this skill's scope and appropriately delegate non-authoring tasks to other specialized skills (optimization, testing, toolchain, auditing).
25-32: LGTM! Quick Start accurately summarizes the 4-turn workflow.The 5-step guide correctly captures the essential flow and aligns with the detailed orchestration defined in lines 46-109.
33-39: LGTM! Excellent addition to prevent common security anti-patterns.This section equips the AI assistant to push back on dangerous rationalizations that often lead to security vulnerabilities. Each statement directly addresses one of the mandatory security rules defined later in the file.
40-45: LGTM! Clear mode definitions with appropriate criteria.The three modes (new/modify/component) are well-defined with clear distinctions. The parallel structure using "User wants to" enhances clarity and consistency.
46-63: LGTM! Turn 1 provides clear understanding and reference loading logic.The orchestration's first turn effectively guides mode classification, existing code inspection, and intelligent reference loading via the mapping table. The Glob-based directory resolution (line 63) is a practical approach for finding the skill directory dynamically.
65-98: LGTM! Turn 2 and Turn 3 provide prescriptive implementation guidance.Turn 2 clearly defines the required plan outputs with appropriate scope constraints (30 lines, wait for confirmation).
Turn 3 effectively combines structure rules, mandatory security rules, and a detailed 7-step component wiring checklist. The security rules here align with the Security-Critical Rules section (lines 110-118), and the scarb build verification provides immediate feedback.
100-109: LGTM! Turn 4 completes the verification loop with clear next steps.The verification phase appropriately combines security rule checking, optional test execution, and explicit handoff suggestions to testing and auditing tools. This aligns perfectly with workflows/default.md Phase 4.
110-119: LGTM! Non-negotiable security rules are clear and consistent.The five security-critical rules are well-defined and consistent with their usage in Turn 3 (lines 82-87) and README (lines 33-42). The "zero class hash" phrasing (line 116) is appropriate as "class hash" is a Starknet-specific term used consistently throughout the documentation.
128-130: LGTM! Appropriate reference to the workflow detail file.The link to workflows/default.md correctly establishes the relationship where SKILL.md orchestrates execution and default.md provides phase-specific reference details.
120-127: All referenced files exist in the repository. No action needed.
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-testing/README.md`:
- Around line 57-59: Add a language specifier to the fenced code block
containing "cairo-contract-authoring → cairo-testing → cairo-auditor" so
markdown linters recognize it; replace the opening triple backticks with a
language tag (e.g., change ``` to ```text) and leave the closing triple
backticks unchanged to produce a fenced block like ```text ... ``` in the
README.md.
- Around line 46-53: Add a language specifier (e.g., "text") to the fenced code
block that contains the directory tree listing (the triple-backtick block
showing "cairo-testing/ SKILL.md references/ ... workflows/") so it becomes
```text ... ```, which satisfies markdown linters; update the README.md fenced
block accordingly.
In `@cairo-testing/SKILL.md`:
- Line 13: Update the non-standard phrase in the SKILL.md description sentence
that currently reads "Your job is to understand what the user needs tested…" to
the standard English form "Your job is to understand what the user needs to be
tested…" so the full sentence becomes: "You are a Cairo testing assistant. Your
job is to understand what the user needs to be tested, load the right
references, write correct tests, verify they pass, and ensure adequate
coverage." Ensure only this grammatical change is made and surrounding
punctuation remains unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: f7ee7280-2930-4da4-8399-113d87b8b344
📒 Files selected for processing (3)
cairo-testing/README.mdcairo-testing/SKILL.mdcairo-testing/workflows/default.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-testing/README.mdcairo-testing/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-testing/README.mdcairo-testing/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-testing/README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-testing/SKILL.md
📚 Learning: 2026-03-08T13:12:39.745Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-08T13:12:39.745Z
Learning: Applies to **/*eval*.{py,cairo,txt} : Detection quality changes must add or update evaluation cases
Applied to files:
cairo-testing/SKILL.md
🪛 LanguageTool
cairo-testing/workflows/default.md
[style] ~23-~23: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... path, correct caller, valid inputs). - Write negative tests (`#[should_panic(expecte...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~24-~24: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ....')]for auth failures, bad inputs). - Write event tests usingspy_events+asser...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~25-~25: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...sing spy_events + assert_emitted. - Write fuzz tests with `#[fuzzer(runs: 256, se...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-testing/SKILL.md
[style] ~13-~13: The double modal “needs tested” is nonstandard (only accepted in certain dialects). Consider “to be tested”.
Context: ...ob is to understand what the user needs tested, load the right references, write corre...
(NEEDS_FIXED)
[style] ~135-~135: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...s both a positive and negative test. 2. Every access-controlled function is tested wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.21.0)
cairo-testing/README.md
[warning] 46-46: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 57-57: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (4)
cairo-testing/workflows/default.md (1)
1-38: LGTM — Workflow structure is clear and actionable.The 5-phase workflow (Scope → Plan → Implement → Verify → Handoff) provides concrete, executable guidance. The orchestration reference to SKILL.md correctly establishes the source of authority, and each phase includes specific commands and deliverables.
cairo-testing/SKILL.md (2)
52-129: LGTM — 4-turn orchestration is comprehensive and actionable.The turn-based workflow clearly separates concerns:
- Turn 1 loads context and references based on a helpful mapping table
- Turn 2 generates an explicit plan and waits for confirmation (avoiding wasted implementation effort)
- Turn 3 enforces mandatory coverage rules during implementation
- Turn 4 verifies completeness and suggests follow-up skills
The reference loading table (lines 68-76) provides concrete guidance, and the mandatory coverage rules (lines 97-102) align with security best practices.
130-138: LGTM — Security rules are non-negotiable and well-defined.The 5 security-critical rules cover the essential testing requirements:
- Positive and negative test coverage
- Access control verification
- Explicit panic message assertions
- Complete event data verification
- Reproducible fuzz tests
These rules align with the retrieved learnings about access control, unsafe patterns, and comprehensive testing for Cairo contracts.
cairo-testing/README.md (1)
1-61: LGTM — User-facing documentation is clear and comprehensive.The README provides:
- Clear purpose and target audience (lines 5-9)
- Practical usage examples (lines 15-23)
- Concise 4-turn workflow summary that aligns with SKILL.md (lines 27-32)
- Non-negotiable coverage rules matching the security-critical rules in SKILL.md (lines 34-42)
- Accurate directory structure (lines 46-53)
- Recommended skill flow integration (lines 55-61)
The documentation successfully bridges user needs with the prescriptive orchestration in SKILL.md.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-optimization/SKILL.md`:
- Around line 32-36: The documented runnable commands in SKILL.md (Quick Start,
Baseline, BoundedInt flows) assume the cwd is cairo-optimization rather than
using the resolved {skill_dir}; update every command that invokes scripts (e.g.,
scripts/profile.py, scripts/bounded_int_calc.py, cairo-auditor, snforge test) to
either prefix with {skill_dir}/ (for example {skill_dir}/scripts/profile.py) or
explicitly run via cd {skill_dir} && ..., and ensure the text around
"{skill_dir}" (lines referenced around 66–78, 78, and 114–117) consistently uses
the same {skill_dir} variable so all flows are runnable from the repo root by
the orchestrator and agent.
- Line 7: The workflow declares allowed-tools: [Bash, Read, Write, Glob, Grep,
Task] but the profiling Turn 1 expects to inspect a PNG, which is not
machine-readable; update the profiler to emit a textual/machine-readable summary
(e.g., JSON or newline-delimited text) that includes hotspot rankings, or modify
the orchestration to consume that textual summary instead of the PNG;
specifically change the profiling step (referenced as "profiling" / "Turn 1" and
the allowed-tools entry) so the profiler produces a parseable artifact
(JSON/text) and update downstream consumers to read that artifact rather than
opening the PNG.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 48d08d94-e3fa-4b83-96f4-0daaf38472ba
📒 Files selected for processing (3)
cairo-optimization/README.mdcairo-optimization/SKILL.mdcairo-optimization/workflows/default.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-optimization/README.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-optimization/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-optimization/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-optimization/README.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-optimization/workflows/default.md
🪛 LanguageTool
cairo-optimization/SKILL.md
[style] ~48-~48: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...entify hotspots. - arithmetic: User wants to optimize math (DivRem, loops, Poseidon)...
(REP_WANT_TO_VB)
[style] ~50-~50: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...modular arithmetic. - storage: User wants to pack storage fields or reduce slot usag...
(REP_WANT_TO_VB)
[style] ~58-~58: Consider using the more polite verb “ask” (“tell” implies ordering/instructing someone).
Context: ...rge test` — if any test fails, stop and tell the user to fix tests first. (c) Read ...
(TELL_ASK)
[style] ~101-~101: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...p tables instead of pow() (Rule 3). - Use pop_front / for / multi_pop_front...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~105-~105: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecks instead of bitwise ops (Rule 7). - Use the smallest integer type that fits the...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~106-~106: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...er type that fits the range (Rule 8). - Use hades_permutation for 2-input Poseido...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🔇 Additional comments (1)
cairo-optimization/workflows/default.md (1)
36-38: The reference toevals/cases/contract_skill_benchmark.jsonlis correct. This unified benchmark pack contains cases for bothcairo-contract-authoringandcairo-optimizationskills, with explicit optimization test cases includingoptimization_arithmeticandoptimization_loopscategories. No action needed.
omarespejel
changed the title
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
cairo-contract-authoring/README.md (1)
37-41:⚠️ Potential issue | 🟡 MinorMinor ordering inconsistency with SKILL.md Security-Critical Rules.
The security rules here list Constructor (line 39) before Upgrade (line 40), but SKILL.md lines 115-119 list Upgrade (line 117) before Constructor (line 118). While the content is correct, consistent ordering across both files would improve cross-referencing and maintenance.
📋 Proposed alignment with SKILL.md
- Timelock checks read from `get_block_timestamp()`, never from caller arguments - Every storage-mutating external function has explicit access posture: **guarded** (owner/role check) or **documented-public** (with inline reason) -- Constructor validates all critical addresses are non-zero - Upgrade flows reject zero class hash +- Constructor validates all critical addresses are non-zero - Anti-pattern/secure-pattern pairs are enforced — the anti-pattern is never written🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/README.md` around lines 37 - 41, Reorder the two list items so "Upgrade flows reject zero class hash" appears before "Constructor validates all critical addresses are non-zero" to match the SKILL.md ordering; update the README list ordering (the entries referencing Upgrade and Constructor) so cross-references and maintenance are consistent with SKILL.md.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-contract-authoring/SKILL.md`:
- Around line 84-88: Reorder the Turn 3 bullet list to match the
Security-Critical Rules ordering (Timelock → access posture → Upgrade →
Constructor → Anti-pattern) so the two sections are consistent: move the
"Timelock checks MUST read time from get_block_timestamp()" item before the
"access posture" item, keep the access posture line referencing guarded
(assert_only_owner / role check) and public-comment requirement, keep the
Upgrade line with assert!(new_class_hash.is_non_zero(), "class_hash_zero"), keep
the Constructor line with assert!(!owner.is_zero(), "owner_zero"), and retain
the anti-pattern reference to references/anti-pattern-pairs.md.
In `@evals/cases/contract_skill_benchmark.jsonl`:
- Around line 77-78: Add paired benchmark cases for the split_half mutator to
mirror the existing set_fee checks: create new eval cases (one for secure and
one for insecure fixtures) that assert split_half is declared with the attribute
#[external(v0)] and includes the owner guard assert_only_owner(`@self`). Reference
the split_half function signature (e.g., fn split_half(ref self: ContractState,
...) ) and ensure the must_match pattern verifies the attribute and the
assert_only_owner guard, and set expected_pass true for the secure fixture and
false for the insecure fixture so regressions of the external(v0) + owner-guard
ABI are detected.
In `@evals/cases/contract_skill_generation_eval.jsonl`:
- Line 13: The negative test only enforces "guard before write" for set_fee but
not for split_half; update the eval case in contract_skill_generation_eval.jsonl
to add a must_not_match entry for split_half mirroring set_fee's pattern (search
for "#[external(v0)] fn split_half(ref self: ContractState, amount: u128) { ...
self.some_state.write" and ensure it prohibits state writes before
assert_only_owner(`@self`);) so split_half is also rejected if it mutates state
prior to calling assert_only_owner.
---
Duplicate comments:
In `@cairo-contract-authoring/README.md`:
- Around line 37-41: Reorder the two list items so "Upgrade flows reject zero
class hash" appears before "Constructor validates all critical addresses are
non-zero" to match the SKILL.md ordering; update the README list ordering (the
entries referencing Upgrade and Constructor) so cross-references and maintenance
are consistent with SKILL.md.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9f342516-40ca-48cb-924d-c3b248064194
📒 Files selected for processing (5)
cairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.mdevals/cases/contract_skill_benchmark.jsonlevals/cases/contract_skill_generation_eval.jsonl
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
🧠 Learnings (8)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-08T13:12:39.745Z
Learning: Applies to **/*eval*.{py,cairo,txt} : Detection quality changes must add or update evaluation cases
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
evals/cases/contract_skill_benchmark.jsonlcairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdevals/cases/contract_skill_generation_eval.jsonl
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
evals/cases/contract_skill_benchmark.jsonlcairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdevals/cases/contract_skill_generation_eval.jsonl
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
evals/cases/contract_skill_benchmark.jsonlcairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.mdevals/cases/contract_skill_generation_eval.jsonl
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
evals/cases/contract_skill_benchmark.jsonlcairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.mdevals/cases/contract_skill_generation_eval.jsonl
📚 Learning: 2026-03-08T13:12:39.745Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-08T13:12:39.745Z
Learning: Applies to **/*eval*.{py,cairo,txt} : Detection quality changes must add or update evaluation cases
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_generation_eval.jsonl
📚 Learning: 2026-03-08T13:12:39.745Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-08T13:12:39.745Z
Learning: Keep this repo focused on correctness, security patterns, and evaluation-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.md
🪛 LanguageTool
cairo-contract-authoring/SKILL.md
[style] ~45-~45: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
cairo-contract-authoring/workflows/default.md
[style] ~15-~15: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ut storage plan: fields, types, maps. - Output component plan: which OZ components, wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~16-~16: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...hich OZ components, wiring checklist. - Output events plan: emitted events, event para...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~17-~17: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ts, event params, and trigger points. - Output security posture: for each external fun...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🔇 Additional comments (8)
cairo-contract-authoring/README.md (1)
1-63: Excellent user-facing documentation.The README provides clear usage examples, explains the 4-turn workflow, lists mandatory security rules, and shows the recommended toolchain flow. The structure is well-organized and appropriate for users new to the skill.
cairo-contract-authoring/SKILL.md (4)
49-65: LGTM! Clear reference-loading orchestration.Turn 1 provides explicit guidance on mode classification and reference loading, with a well-structured table mapping request types to specific reference files. The
{skill_dir}resolution guidance is particularly helpful.
66-74: LGTM! Comprehensive planning phase.Turn 2 appropriately requires a complete plan covering interface, storage, components, events, and security posture before implementation, with an explicit confirmation gate to ensure alignment.
101-109: LGTM! Thorough verification and handoff.Turn 4 appropriately re-checks security rules, runs existing tests, and suggests the next steps in the toolchain (cairo-testing → cairo-auditor), providing clear handoff guidance.
133-138: LGTM! Eval Gate aligns with detection quality requirements.The Eval Gate appropriately requires updating evaluation cases when security rules or references change, consistent with the repository's quality standards. Based on learnings, detection quality changes must add or update evaluation cases.
cairo-contract-authoring/workflows/default.md (3)
5-18: LGTM! Phases align well with SKILL.md orchestration.Phase 1 and Phase 2 properly match SKILL.md's Turn 1 and Turn 2, including all five planning components (interface, storage, component, events, security posture) with an explicit confirmation gate. The past review comment about missing Events has been addressed.
20-31: LGTM! Implementation phase covers critical patterns.Phase 3 appropriately covers ownership semantics, trait constraints, invariants, auth checks, timelock patterns, and upgrade validation, concluding with compilation verification via
scarb build.
32-43: LGTM! Verification and handoff phases complete the workflow.Phase 4 appropriately re-checks security rules and suggests the recommended toolchain flow (cairo-testing → cairo-auditor). Phase 5 provides optional handoff steps with a clearly marked
<project-root>placeholder. The past review comment about the placeholder has been addressed.
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-1:⚠️ Potential issue | 🟠 MajorAdd required YAML frontmatter.
This markdown file is missing YAML frontmatter with required
nameanddescriptionfields. As per coding guidelines, all markdown files must include frontmatter.📋 Proposed frontmatter addition
+--- +name: "starknet-skills" +description: "Cairo/Starknet skills for AI coding agents — security knowledge layer for Claude Code, Cursor, and any agent that reads markdown." +--- + # starknet-skills🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 1, The README is missing required YAML frontmatter; add a YAML block at the very top delimited by --- that includes at minimum name and description keys (e.g., name: "starknet-skills" and a short description), ensure the YAML is valid, close the block with --- and leave a blank line before the existing content (the header "# starknet-skills") so the frontmatter is correctly parsed.
♻️ Duplicate comments (3)
cairo-testing/README.md (2)
96-98:⚠️ Potential issue | 🟡 MinorAdd language specifier to code block.
The flow diagram code block lacks a language specifier for proper markdown rendering.
🔧 Proposed fix
-``` +```text cairo-contract-authoring → cairo-testing → cairo-auditor</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@cairo-testing/README.mdaround lines 96 - 98, The markdown code block
containing the flow line "cairo-contract-authoring → cairo-testing →
cairo-auditor" should include a language specifier for correct rendering; update
the opening fence fromtotext (or another appropriate language) so the
block becomes fenced withtext and the closing fence remains, ensuring
the exact code block that contains that flow diagram is modified.</details> --- `85-92`: _⚠️ Potential issue_ | _🟡 Minor_ **Add language specifier to code block.** The directory structure code block lacks a language specifier, which is flagged by markdown linters. <details> <summary>🔧 Proposed fix</summary> ```diff -``` +```text cairo-testing/ SKILL.md # 4-turn orchestration ``` </details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@cairo-testing/README.mdaround lines 85 - 92, The README.md
directory-structure code block is missing a language specifier which markdown
linters flag; edit the code block in cairo-testing/README.md (the block showing
"cairo-testing/ SKILL.md references/ workflows/") and add an explicit language
tag (for example "text") after the opening triple backticks so the block becomescairo-contract-authoring/README.md (1)
54-64:⚠️ Potential issue | 🟡 MinorAdd language specifier to code block.
The directory structure code block should specify a language (e.g.,
text) to satisfy markdown linters and improve rendering.🔧 Proposed fix
-``` +```text cairo-contract-authoring/ SKILL.md # 4-turn orchestration🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/README.md` around lines 54 - 64, The fenced directory listing in README.md lacks a language specifier; update the opening fence for the directory structure code block from ``` to ```text so markdown linters render it correctly and the block (the cairo-contract-authoring/ listing and its nested files like SKILL.md, references/, workflows/) is marked as plain text.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-contract-authoring/README.md`:
- Line 1: The README.md is missing required YAML frontmatter; add a frontmatter
block at the top of the file containing at minimum the name and description keys
(for example set name: "cairo-contract-authoring" and a short description
summarizing the project) so the file begins with the YAML block (---, name:,
description:, ...) followed by the existing content header "#
cairo-contract-authoring".
- Around line 68-71: Update the fenced code block that contains
"cairo-contract-authoring → cairo-testing → cairo-auditor" to include a
language specifier (e.g., "text") after the opening triple backticks so the flow
diagram renders correctly in Markdown; locate the block in README.md that shows
the three-project flow and change the opening fence from ``` to ```text.
In `@cairo-optimization/README.md`:
- Line 1: The README.md is missing required YAML frontmatter; add a YAML
frontmatter block at the top of the file containing at minimum the name and
description fields (e.g., name: "cairo-optimization" and a brief description) so
the file conforms to project guidelines; ensure the frontmatter is the first
thing in README.md (before any content) and is properly delimited with
triple-dashes.
- Around line 73-85: The fenced code block showing the directory tree is missing
a language specifier; update the opening fence from ``` to ```text so linters
recognize it (i.e., change the triple-backtick that precedes
"cairo-optimization/" to "```text" and leave the closing fence unchanged) to fix
the Markdown lint warning.
- Around line 89-92: Add a language specifier to the fenced code block that
contains the flow diagram (the block with "cairo-contract-authoring →
cairo-testing → cairo-optimization → cairo-auditor") so it renders
correctly; change the opening triple backticks to include the language (e.g.,
```text) for that code block in README.md.
In `@cairo-testing/README.md`:
- Line 1: The README.md is missing required YAML frontmatter; add a top-of-file
YAML block containing at least the name and description fields (e.g., a
triple-dashed block with name: "cairo-testing" and description: "short
description of this repo") so the document complies with the coding guidelines;
ensure the frontmatter is the very first content in the file and uses valid YAML
syntax.
---
Outside diff comments:
In `@README.md`:
- Line 1: The README is missing required YAML frontmatter; add a YAML block at
the very top delimited by --- that includes at minimum name and description keys
(e.g., name: "starknet-skills" and a short description), ensure the YAML is
valid, close the block with --- and leave a blank line before the existing
content (the header "# starknet-skills") so the frontmatter is correctly parsed.
---
Duplicate comments:
In `@cairo-contract-authoring/README.md`:
- Around line 54-64: The fenced directory listing in README.md lacks a language
specifier; update the opening fence for the directory structure code block from
``` to ```text so markdown linters render it correctly and the block (the
cairo-contract-authoring/ listing and its nested files like SKILL.md,
references/, workflows/) is marked as plain text.
In `@cairo-testing/README.md`:
- Around line 96-98: The markdown code block containing the flow line
"cairo-contract-authoring → cairo-testing → cairo-auditor" should include a
language specifier for correct rendering; update the opening fence from ``` to
```text (or another appropriate language) so the block becomes fenced with
```text and the closing fence remains ```, ensuring the exact code block that
contains that flow diagram is modified.
- Around line 85-92: The README.md directory-structure code block is missing a
language specifier which markdown linters flag; edit the code block in
cairo-testing/README.md (the block showing "cairo-testing/ SKILL.md references/
workflows/") and add an explicit language tag (for example "text") after the
opening triple backticks so the block becomes ```text, ensuring the rest of the
block content remains unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: eec11d98-072b-4900-a0e2-d0b2dc01281c
📒 Files selected for processing (4)
README.mdcairo-contract-authoring/README.mdcairo-optimization/README.mdcairo-testing/README.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (1)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdREADME.mdcairo-testing/README.md
🧠 Learnings (9)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-testing/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdREADME.mdcairo-testing/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdREADME.mdcairo-testing/README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Run `python scripts/quality/validate_skills.py` to perform structure validation of skills
Applied to files:
README.md
🪛 markdownlint-cli2 (0.21.0)
cairo-optimization/README.md
[warning] 85-85: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 96-96: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
cairo-contract-authoring/README.md
[warning] 54-54: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 68-68: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (2)
README.md (2)
24-44: Excellent restructuring for user experience.The new skills table and flow diagram provide immediate clarity on what's available and how the tools work together. This is a significant improvement over the previous structure.
119-190: Good maintainer content organization.Collapsing the maintainer-specific content (data pipeline, quality signals, methodology, publish checklist) into a
<details>section keeps the README focused on users while preserving essential information for contributors.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-2:⚠️ Potential issue | 🟠 MajorAdd the required YAML frontmatter.
This file now changes substantial README content, but it still has no frontmatter block. If your Markdown tooling enforces repository metadata, this will fail that contract.
Suggested fix
+--- +name: starknet-skills +description: Cairo/Starknet skills for AI coding agents, including auditing, contract authoring, testing, and optimization workflows. +--- + # starknet-skillsAs per coding guidelines, "
**/*.md: Markdown files must include YAML frontmatter with required fields:nameanddescription"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 1 - 2, The README.md is missing required YAML frontmatter; add a top-level YAML block (--- ... ---) before the "# starknet-skills" header that includes at minimum the name and description fields (e.g., name: "starknet-skills" and a brief description string) so the Markdown tooling can read repository metadata; ensure the frontmatter is valid YAML and placed at the very start of the file.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 35-42: The markdown code fences in README.md (notably the ASCII
diagram block around the contract-authoring/testing/optimization/auditor flow
and the URL/list/code blocks referenced at lines ~35-42, 62-73, and 124-128) are
missing fence language specifiers and triggering MD040; update each
triple-backtick fence to include a concrete info string such as text (for
diagrams and plain URLs) or mermaid (for flow diagrams you want rendered), e.g.,
replace ``` with ```text (or ```mermaid where appropriate) for every affected
block so tooling stops flagging MD040 and the content renders correctly.
---
Outside diff comments:
In `@README.md`:
- Around line 1-2: The README.md is missing required YAML frontmatter; add a
top-level YAML block (--- ... ---) before the "# starknet-skills" header that
includes at minimum the name and description fields (e.g., name:
"starknet-skills" and a brief description string) so the Markdown tooling can
read repository metadata; ensure the frontmatter is valid YAML and placed at the
very start of the file.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2de83fa7-93ec-4736-ad19-a9853412fb98
📒 Files selected for processing (1)
README.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (1)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
README.md
🧠 Learnings (5)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Run `python scripts/quality/validate_skills.py` to perform structure validation of skills
Applied to files:
README.md
🪛 markdownlint-cli2 (0.21.0)
README.md
[warning] 35-35: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 62-62: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 68-68: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 124-124: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
omarespejel
changed the title
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (5)
cairo-contract-authoring/README.md (2)
49-55:⚠️ Potential issue | 🟡 MinorKeep security rule ordering aligned with
SKILL.md.The README rule order differs from the canonical order in
cairo-contract-authoring/SKILL.md, which makes cross-referencing harder.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/README.md` around lines 49 - 55, The README.md rules table is out of order compared to the canonical ordering in cairo-contract-authoring/SKILL.md; update the table rows in README.md so the numbered rules and their descriptions match the exact sequence in SKILL.md (e.g., ensure entries for "Every storage-mutating external...", "Constructor validates...", "Upgrade flows reject...", "Timelock checks read from get_block_timestamp()", and "Anti-pattern/secure-pattern pairs..." appear in the same order and wording as SKILL.md); keep numbering consistent and preserve bolding/formatting so cross-references to SKILL.md align precisely.
59-69:⚠️ Potential issue | 🟡 MinorAdd language specifiers to fenced code blocks.
The structure and flow diagram blocks use unlabeled fences; please switch to ```text for consistent markdown rendering/lint behavior.
Also applies to: 73-76
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/README.md` around lines 59 - 69, The README has unlabeled fenced code blocks (the directory tree block starting with "cairo-contract-authoring/" and the subsequent flow/structure blocks) which should be annotated with a language specifier; replace the opening triple backticks for those blocks with ```text so the directory/flow diagrams render consistently with markdown linters and viewers, and update all other similar unlabeled fences in the file (including the blocks around the workflows/default.md reference) to use ```text.cairo-contract-authoring/SKILL.md (1)
87-92:⚠️ Potential issue | 🟡 MinorMake security-rule ordering consistent within this file.
Turn 3 and
Security-Critical Rulesuse different ordering for the same rule set; align them to reduce operator confusion.Also applies to: 119-124
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 87 - 92, Align the ordering of the security rules between the "Turn 3" section and the "Security-Critical Rules" section by reordering the list items so both use the same sequence: 1) storage-mutating functions must have explicit access posture (guarded or documented public) referencing #[abi(embed_v0)] / #[external(v0)] and examples like assert_only_owner, 2) constructor must validate critical addresses non-zero (e.g., assert!(!owner.is_zero(), "owner_zero")), 3) upgrade flows must reject zero class hash (e.g., assert!(new_class_hash.is_non_zero(), "class_hash_zero")), 4) timelock checks must use get_block_timestamp(), and 5) use secure-pattern pairs from references/anti-pattern-pairs.md; apply the same reordered wording and exact rule phrasing to the other occurrence noted (lines 119-124) so both sections are identical.cairo-optimization/SKILL.md (2)
66-66:⚠️ Potential issue | 🟠 MajorThe profiling step remains incompatible with the declared toolset.
Line 66 instructs the agent to "Read the output PNG to identify top hotspots," but
allowed-tools(line 7) only provides[Bash, Read, Write, Glob, Grep, Task]. TheReadtool cannot parse binary PNG files.Update the profiler to emit machine-readable output (JSON or text) containing hotspot rankings, or modify the orchestration to consume a textual profiler summary.
🔧 Suggested fix
-(d) Profile the baseline. Run `python3 scripts/profile.py profile` with the appropriate arguments. Read the output PNG to identify top hotspots by steps. +(d) Profile the baseline. Run `python3 scripts/profile.py profile` with the appropriate arguments. Read the profiler's text summary to identify top hotspots by steps.Additionally, ensure
scripts/profile.pyoutputs a machine-readable summary file (e.g.,profile_summary.jsonorprofile_summary.txt).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` at line 66, The profiling step instructs users to "Read the output PNG" but the declared allowed-tools only include text/file readers (allowed-tools) and cannot parse binary PNGs; update scripts/profile.py to emit a machine-readable summary (e.g., profile_summary.json or profile_summary.txt) alongside the PNG and change the orchestration to consume that summary instead of the PNG; specifically modify scripts/profile.py to write hotspot rankings to a JSON/text file and update any caller logic that references the PNG-reading step to read profile_summary.json (or profile_summary.txt) using the Read tool so hotspot identification works with the allowed-tools.
33-33:⚠️ Potential issue | 🟠 MajorUse
{skill_dir}prefix consistently in script invocations.Lines 33, 66, 114, and 117 invoke scripts under
scripts/without the{skill_dir}prefix. Since line 78 explains how to resolve{skill_dir}for repo-root execution, all script paths should use it consistently.🔧 Proposed fix
-2. Profile hot paths with `python3 scripts/profile.py profile`. +2. Profile hot paths with `python3 {skill_dir}/scripts/profile.py profile`.-(d) Profile the baseline. Run `python3 scripts/profile.py profile` with the appropriate arguments. Read the output PNG to identify top hotspots by steps. +(d) Profile the baseline. Run `python3 {skill_dir}/scripts/profile.py profile` with the appropriate arguments. Read the profiler summary to identify top hotspots by steps.-- Always use `python3 scripts/bounded_int_calc.py` to compute bounds — never calculate manually. +- Always use `python3 {skill_dir}/scripts/bounded_int_calc.py` to compute bounds — never calculate manually.-After each optimization, run `snforge test` and `python3 scripts/profile.py profile` to verify improvement. +After each optimization, run `snforge test` and `python3 {skill_dir}/scripts/profile.py profile` to verify improvement.Also applies to: 66-66, 114-114, 117-117
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` at line 33, Update all script invocations to use the {skill_dir} prefix so commands like the profile/benchmark/script examples use {skill_dir}/scripts/... instead of scripts/...; specifically replace the occurrences of "python3 scripts/profile.py profile" and the two other script calls referenced at lines 66, 114, and 117 with their {skill_dir}/scripts/... equivalents in SKILL.md so examples are consistent with the repo-root execution guidance (search for the literal "scripts/" occurrences in the document to locate each instance).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-contract-authoring/SKILL.md`:
- Around line 94-102: The "Component wiring (when using OZ components):" section
in SKILL.md contains step-by-step implementation details that should be moved to
a dedicated guide; remove the detailed numbered wiring steps from SKILL.md (the
entire "Component wiring (when using OZ components):" block) and replace them
with a short pointer sentence linking to the new or existing detailed guide
under references/ or workflows/ (e.g., "See
references/workflows/component-wiring.md for full steps"). Ensure the detailed
checklist (use import, component!, #[abi(embed_v0)], internal impl aliases,
#[substorage(v0)], #[flat] variants, .initializer(...)) is migrated into the
referenced document so the procedural content lives in references/workflows
while SKILL.md remains concise.
In `@cairo-contract-authoring/workflows/default.md`:
- Around line 1-4: This markdown is missing required YAML frontmatter; add a
top-of-file YAML block containing at least name and description (e.g., name:
"Default Workflow" and a short description) above the "Default Workflow" heading
so the file complies with the guideline requiring `name` and `description` in
all .md files.
---
Duplicate comments:
In `@cairo-contract-authoring/README.md`:
- Around line 49-55: The README.md rules table is out of order compared to the
canonical ordering in cairo-contract-authoring/SKILL.md; update the table rows
in README.md so the numbered rules and their descriptions match the exact
sequence in SKILL.md (e.g., ensure entries for "Every storage-mutating
external...", "Constructor validates...", "Upgrade flows reject...", "Timelock
checks read from get_block_timestamp()", and "Anti-pattern/secure-pattern
pairs..." appear in the same order and wording as SKILL.md); keep numbering
consistent and preserve bolding/formatting so cross-references to SKILL.md align
precisely.
- Around line 59-69: The README has unlabeled fenced code blocks (the directory
tree block starting with "cairo-contract-authoring/" and the subsequent
flow/structure blocks) which should be annotated with a language specifier;
replace the opening triple backticks for those blocks with ```text so the
directory/flow diagrams render consistently with markdown linters and viewers,
and update all other similar unlabeled fences in the file (including the blocks
around the workflows/default.md reference) to use ```text.
In `@cairo-contract-authoring/SKILL.md`:
- Around line 87-92: Align the ordering of the security rules between the "Turn
3" section and the "Security-Critical Rules" section by reordering the list
items so both use the same sequence: 1) storage-mutating functions must have
explicit access posture (guarded or documented public) referencing
#[abi(embed_v0)] / #[external(v0)] and examples like assert_only_owner, 2)
constructor must validate critical addresses non-zero (e.g.,
assert!(!owner.is_zero(), "owner_zero")), 3) upgrade flows must reject zero
class hash (e.g., assert!(new_class_hash.is_non_zero(), "class_hash_zero")), 4)
timelock checks must use get_block_timestamp(), and 5) use secure-pattern pairs
from references/anti-pattern-pairs.md; apply the same reordered wording and
exact rule phrasing to the other occurrence noted (lines 119-124) so both
sections are identical.
In `@cairo-optimization/SKILL.md`:
- Line 66: The profiling step instructs users to "Read the output PNG" but the
declared allowed-tools only include text/file readers (allowed-tools) and cannot
parse binary PNGs; update scripts/profile.py to emit a machine-readable summary
(e.g., profile_summary.json or profile_summary.txt) alongside the PNG and change
the orchestration to consume that summary instead of the PNG; specifically
modify scripts/profile.py to write hotspot rankings to a JSON/text file and
update any caller logic that references the PNG-reading step to read
profile_summary.json (or profile_summary.txt) using the Read tool so hotspot
identification works with the allowed-tools.
- Line 33: Update all script invocations to use the {skill_dir} prefix so
commands like the profile/benchmark/script examples use {skill_dir}/scripts/...
instead of scripts/...; specifically replace the occurrences of "python3
scripts/profile.py profile" and the two other script calls referenced at lines
66, 114, and 117 with their {skill_dir}/scripts/... equivalents in SKILL.md so
examples are consistent with the repo-root execution guidance (search for the
literal "scripts/" occurrences in the document to locate each instance).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 92d78f23-26cb-487a-82ff-d6c80058974a
📒 Files selected for processing (6)
cairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-optimization/README.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (2)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
🧠 Learnings (11)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-optimization/README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-testing/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
🪛 LanguageTool
cairo-contract-authoring/workflows/default.md
[style] ~15-~15: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ut storage plan: fields, types, maps. - Output component plan: which OZ components, wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~16-~16: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...hich OZ components, wiring checklist. - Output events plan: emitted events, event para...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~17-~17: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ts, event params, and trigger points. - Output security posture: for each external fun...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
cairo-optimization/SKILL.md
[style] ~48-~48: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...entify hotspots. - arithmetic: User wants to optimize math (DivRem, loops, Poseidon)...
(REP_WANT_TO_VB)
[style] ~50-~50: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...modular arithmetic. - storage: User wants to pack storage fields or reduce slot usag...
(REP_WANT_TO_VB)
[style] ~58-~58: Consider using the more polite verb “ask” (“tell” implies ordering/instructing someone).
Context: ...rge test` — if any test fails, stop and tell the user to fix tests first. (c) Read ...
(TELL_ASK)
[style] ~101-~101: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...p tables instead of pow() (Rule 3). - Use pop_front / for / multi_pop_front...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~105-~105: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecks instead of bitwise ops (Rule 7). - Use the smallest integer type that fits the...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~106-~106: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...er type that fits the range (Rule 8). - Use hades_permutation for 2-input Poseido...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🔇 Additional comments (3)
cairo-optimization/README.md (3)
1-4: YAML frontmatter added successfully.The previously flagged missing frontmatter is now present with the required
nameanddescriptionfields.
78-90: Code block language specifiers added.The previously flagged missing language specifiers for the directory structure (lines 78-90) and flow diagram (lines 94-97) are now present.
Also applies to: 94-97
1-105: Excellent user-facing documentation.This README successfully unifies the documentation structure with:
- Clear skill purpose and audience
- Practical usage examples
- Well-organized 4-turn workflow table
- Comprehensive optimization rules reference
- Helpful example and recommended flow diagram
The file complements SKILL.md appropriately and provides a strong user experience.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
README.md (1)
1-1:⚠️ Potential issue | 🟠 MajorAdd required YAML frontmatter at the top of this markdown file.
Line 1 starts with content, but this repository requires markdown frontmatter with
nameanddescription.Suggested patch
+--- +name: starknet-skills +description: Cairo/Starknet skills for AI coding agents, including authoring, testing, optimization, and auditing workflows. +--- + # starknet-skillsAs per coding guidelines, "Markdown files must include YAML frontmatter with required fields:
nameanddescription".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 1, The README.md is missing the required YAML frontmatter; add a YAML block at the very top of README.md containing the required keys `name` and `description` (e.g., a three-dash delimited frontmatter block `---` with `name: <project name>` and `description: <short description>`), ensuring the frontmatter appears before any other content so tools that parse frontmatter will detect it.
♻️ Duplicate comments (3)
README.md (1)
124-128:⚠️ Potential issue | 🟡 MinorAdd a language identifier to the fenced code block.
Use
text(or another explicit info string) on this fence to satisfy markdown linting consistency.Suggested patch
-``` +```text ingest → segment → normalize → distill → skillize 24 26 217 9 7 audits corpora findings assets skills</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@README.mdaround lines 124 - 128, The fenced code block showing the pipeline
diagram ("ingest → segment → normalize → distill → skillize" with the counts and
labels) needs an explicit info string to satisfy markdown linting; update that
fenced block to start withtext (or another explicit language identifier) so the fence readstext followed by the existing content and then the closingcairo-contract-authoring/SKILL.md (2)
94-102: 🛠️ Refactor suggestion | 🟠 MajorMove component wiring procedure out of SKILL router.
This step-by-step block is too implementation-detailed for the router file; keep a short pointer here and move the checklist to
references/orworkflows/.As per coding guidelines, "Keep SKILL.md concise; details go in
references/andworkflows/subdirectories".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 94 - 102, The SKILL.md router contains an overly detailed component wiring checklist (items referencing use import, component!(...), #[abi(embed_v0)], internal impl aliases, #[substorage(v0)], #[flat], and calling .initializer(...)) that should be relocated; remove or collapse this step-by-step wiring block from the SKILL router file and replace it with a short pointer sentence directing readers to a new detailed document in references/ or workflows/ (create a new markdown file there containing the full checklist and examples keyed to component!(...), #[abi(embed_v0)], #[substorage(v0)], #[flat], and .initializer(...) for discoverability).
87-92: 🧹 Nitpick | 🔵 TrivialUnify security-rule ordering across both sections.
Turn 3 and Security-Critical Rules currently list the same rules in different order, which makes cross-checking harder.
Also applies to: 119-123
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 87 - 92, The two rule lists ("Turn 3" and "Security-Critical Rules") currently contain the same security rules in different orders; unify them by choosing a single canonical ordering and applying it to both sections so the lists match exactly; specifically ensure the ordering of items for #[abi(embed_v0)] / #[external(v0)] access posture, constructor non-zero address check (assert!(!owner.is_zero(), "owner_zero")), upgrade rejection of zero class hash (assert!(new_class_hash != 0, "class_hash_zero")), timelock checks using get_block_timestamp(), and the anti-pattern/secure-pattern reference (references/anti-pattern-pairs.md) is identical in both sections and add a brief note if one section is intended to be authoritative.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-testing/SKILL.md`:
- Around line 90-113: The "Turn 3 — Implement." section in SKILL.md is too
detailed; trim procedural/developer execution guidance (the Structure rules,
Coverage rules, Cheatcode rules, Fuzz rules and the run/test instructions) so
SKILL.md acts only as a concise routing policy, and move the detailed
test-writing steps and cheatcode/fuzzer command specifics into new or existing
documents under references/ or workflows/ (e.g., a references/testing.md or
workflows/test-workflow.md); keep SKILL.md to a short summary with links to
those references and ensure headings like "Turn 3 — Implement.", "Cheatcode
rules", and "Fuzz rules" are replaced with one-line pointers to the detailed
docs.
---
Outside diff comments:
In `@README.md`:
- Line 1: The README.md is missing the required YAML frontmatter; add a YAML
block at the very top of README.md containing the required keys `name` and
`description` (e.g., a three-dash delimited frontmatter block `---` with `name:
<project name>` and `description: <short description>`), ensuring the
frontmatter appears before any other content so tools that parse frontmatter
will detect it.
---
Duplicate comments:
In `@cairo-contract-authoring/SKILL.md`:
- Around line 94-102: The SKILL.md router contains an overly detailed component
wiring checklist (items referencing use import, component!(...),
#[abi(embed_v0)], internal impl aliases, #[substorage(v0)], #[flat], and calling
.initializer(...)) that should be relocated; remove or collapse this
step-by-step wiring block from the SKILL router file and replace it with a short
pointer sentence directing readers to a new detailed document in references/ or
workflows/ (create a new markdown file there containing the full checklist and
examples keyed to component!(...), #[abi(embed_v0)], #[substorage(v0)], #[flat],
and .initializer(...) for discoverability).
- Around line 87-92: The two rule lists ("Turn 3" and "Security-Critical Rules")
currently contain the same security rules in different orders; unify them by
choosing a single canonical ordering and applying it to both sections so the
lists match exactly; specifically ensure the ordering of items for
#[abi(embed_v0)] / #[external(v0)] access posture, constructor non-zero address
check (assert!(!owner.is_zero(), "owner_zero")), upgrade rejection of zero class
hash (assert!(new_class_hash != 0, "class_hash_zero")), timelock checks using
get_block_timestamp(), and the anti-pattern/secure-pattern reference
(references/anti-pattern-pairs.md) is identical in both sections and add a brief
note if one section is intended to be authoritative.
In `@README.md`:
- Around line 124-128: The fenced code block showing the pipeline diagram
("ingest → segment → normalize → distill → skillize" with the counts and labels)
needs an explicit info string to satisfy markdown linting; update that fenced
block to start with ```text (or another explicit language identifier) so the
fence reads ```text followed by the existing content and then the closing ``` to
fix the lint warning.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 594cb45f-5199-4b4b-928e-f37830bed6bb
📒 Files selected for processing (4)
README.mdcairo-contract-authoring/README.mdcairo-contract-authoring/SKILL.mdcairo-testing/SKILL.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (2)
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.md
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdREADME.mdcairo-contract-authoring/README.md
🧠 Learnings (12)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdREADME.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdREADME.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/SKILL.mdREADME.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Run `python scripts/quality/validate_skills.py` to perform structure validation of skills
Applied to files:
README.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-contract-authoring/README.md
🪛 LanguageTool
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~121-~121: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
cairo-testing/SKILL.md
[style] ~13-~13: The double modal “needs tested” is nonstandard (only accepted in certain dialects). Consider “to be tested”.
Context: ...ob is to understand what the user needs tested, load the right references, write corre...
(NEEDS_FIXED)
[style] ~135-~135: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...s both a positive and negative test. 2. Every access-controlled function is tested wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 markdownlint-cli2 (0.21.0)
README.md
[warning] 124-124: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (2)
cairo-optimization/SKILL.md (2)
32-34:⚠️ Potential issue | 🟠 MajorUse
{skill_dir}-qualified script commands consistently.These commands still assume cwd is
cairo-optimization/. Prefix script invocations with{skill_dir}/...(or explicitcd) so flows run reliably from repo root.Proposed fix pattern
-2. Profile hot paths with `python3 scripts/profile.py profile`. +2. Profile hot paths with `python3 {skill_dir}/scripts/profile.py profile`. -(d) Profile the baseline. Run `python3 scripts/profile.py profile` with the appropriate arguments. +(d) Profile the baseline. Run `python3 {skill_dir}/scripts/profile.py profile` with the appropriate arguments. -- Always use `python3 scripts/bounded_int_calc.py` to compute bounds — never calculate manually. +- Always use `python3 {skill_dir}/scripts/bounded_int_calc.py` to compute bounds — never calculate manually. -After each optimization, run `snforge test` and `python3 scripts/profile.py profile` to verify improvement. +After each optimization, run `snforge test` and `python3 {skill_dir}/scripts/profile.py profile` to verify improvement.Also applies to: 66-66, 114-114, 117-117
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` around lines 32 - 34, The commands in SKILL.md assume the current working directory; update each script invocation (e.g., the `snforge test` and `python3 scripts/profile.py profile` lines and the load-reference commands at the other occurrences) to be qualified with the repository skill directory variable `{skill_dir}` (for example `{skill_dir}/snforge test`, `{skill_dir}/python3 {skill_dir}/scripts/profile.py profile`, or an explicit `cd {skill_dir} && ...`) so the flows run reliably from the repo root; apply this pattern to the occurrences referenced (lines around the listed commands and the other noted locations).
66-67:⚠️ Potential issue | 🟠 MajorProfiler flow still depends on PNG inspection.
Line 66 still requires hotspot extraction from a PNG, which is not reliable for orchestration. Please switch to a parseable text/JSON profiler summary for ranking hotspots.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` around lines 66 - 67, The profiler step currently requires manual PNG inspection via the `scripts/profile.py profile` command; modify `scripts/profile.py` (the `profile` subcommand/handler) to emit a machine-readable hotspot summary (JSON or newline-delimited text) that ranks hotspots by steps and write it to a file or stdout (add a `--format json`/`--output-summary` flag), update the profiling routine to compute and serialize the top hotspots by steps (include fields: function/name, steps, total time, sample counts), and update SKILL.md line 66 to instruct users to run `python3 scripts/profile.py profile --output-summary=hotspots.json` and parse that JSON instead of inspecting a PNG.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-contract-authoring/SKILL.md`:
- Line 90: Replace the direct zero-comparison of new_class_hash with Cairo's
idiomatic .is_zero() check: in the upgrade flow where you currently
assert!(new_class_hash != 0, "class_hash_zero"), change it to
assert!(!new_class_hash.is_zero(), "Class hash cannot be zero") or alternatively
remove the manual check and rely on OpenZeppelin's UpgradeableComponent which
already enforces the non-zero class hash invariant; update any references to
new_class_hash in the upgrade function/handler to use the .is_zero() pattern if
keeping the explicit assert.
In `@cairo-optimization/workflows/default.md`:
- Around line 8-10: The workflow currently requires reading a PNG to rank
hotspots; update the profiling script (scripts/profile.py and its "profile"
command) to also emit a machine-readable summary (JSON or newline-delimited
text) containing hotspot records (e.g., step, count, duration, file/line) and
write that summary to a stable filename (e.g., profile_summary.json); then
update the documentation in workflows/default.md to reference and consume that
JSON as the canonical source of truth for ranking hotspots (optionally keep PNG
generation for humans but ensure automation reads the new JSON output).
- Around line 8-18: The runnable commands in the workflow doc use unqualified
paths (e.g., "python3 scripts/profile.py profile" and
"scripts/bounded_int_calc.py") which break when run from the repo root; update
the instructions to use the repository-qualified variable {skill_dir} for script
invocations (e.g., reference python3 {skill_dir}/scripts/profile.py and python3
{skill_dir}/scripts/bounded_int_calc.py) so the commands are runnable from the
repo root and keep existing references to artifacts like
references/legacy-full.md and references/anti-pattern-pairs.md unchanged.
- Around line 1-4: Add YAML frontmatter to the top of the Markdown file by
inserting a YAML block containing the required keys `name` and `description`
before the existing content; update the file "default.md" to start with a
frontmatter block (---) followed by `name:` and `description:` entries and then
close the block (---) so the rest of the document (the title "Default Workflow"
and body) remains unchanged.
---
Duplicate comments:
In `@cairo-optimization/SKILL.md`:
- Around line 32-34: The commands in SKILL.md assume the current working
directory; update each script invocation (e.g., the `snforge test` and `python3
scripts/profile.py profile` lines and the load-reference commands at the other
occurrences) to be qualified with the repository skill directory variable
`{skill_dir}` (for example `{skill_dir}/snforge test`, `{skill_dir}/python3
{skill_dir}/scripts/profile.py profile`, or an explicit `cd {skill_dir} && ...`)
so the flows run reliably from the repo root; apply this pattern to the
occurrences referenced (lines around the listed commands and the other noted
locations).
- Around line 66-67: The profiler step currently requires manual PNG inspection
via the `scripts/profile.py profile` command; modify `scripts/profile.py` (the
`profile` subcommand/handler) to emit a machine-readable hotspot summary (JSON
or newline-delimited text) that ranks hotspots by steps and write it to a file
or stdout (add a `--format json`/`--output-summary` flag), update the profiling
routine to compute and serialize the top hotspots by steps (include fields:
function/name, steps, total time, sample counts), and update SKILL.md line 66 to
instruct users to run `python3 scripts/profile.py profile
--output-summary=hotspots.json` and parse that JSON instead of inspecting a PNG.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: db9ea268-7f18-46e2-9a23-050c0fbcf9dd
📒 Files selected for processing (4)
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-optimization/SKILL.mdcairo-optimization/workflows/default.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (2)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-optimization/SKILL.mdcairo-contract-authoring/SKILL.md
🧠 Learnings (11)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-optimization/workflows/default.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-optimization/SKILL.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-optimization/SKILL.mdcairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
🪛 LanguageTool
cairo-optimization/SKILL.md
[style] ~48-~48: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...entify hotspots. - arithmetic: User wants to optimize math (DivRem, loops, Poseidon)...
(REP_WANT_TO_VB)
[style] ~50-~50: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...modular arithmetic. - storage: User wants to pack storage fields or reduce slot usag...
(REP_WANT_TO_VB)
[style] ~58-~58: Consider using the more polite verb “ask” (“tell” implies ordering/instructing someone).
Context: ...rge test` — if any test fails, stop and tell the user to fix tests first. (c) Read ...
(TELL_ASK)
[style] ~101-~101: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...p tables instead of pow() (Rule 3). - Use pop_front / for / multi_pop_front...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~105-~105: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecks instead of bitwise ops (Rule 7). - Use the smallest integer type that fits the...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~106-~106: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...er type that fits the range (Rule 8). - Use hades_permutation for 2-input Poseido...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-contract-authoring/workflows/default.md
[style] ~20-~20: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ut storage plan: fields, types, maps. - Output component plan: which OZ components, wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~21-~21: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...hich OZ components, wiring checklist. - Output events plan: emitted events, event para...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~22-~22: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ts, event params, and trigger points. - Output security posture: for each external fun...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~116-~116: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
🔇 Additional comments (1)
cairo-contract-authoring/workflows/default.md (1)
1-49: Workflow rewrite is coherent and compliant.Phases, confirmation gate, verification, and eval feedback loop are all clearly defined and align with the router-driven flow.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (6)
cairo-testing/SKILL.md (2)
90-113:⚠️ Potential issue | 🟠 MajorTrim implementation detail from SKILL.md and delegate to workflow/reference docs.
This section is still too procedural for a router file. Keep SKILL.md at policy level and move step-by-step rules to
workflows/default.mdand/orreferences/*, then link to them.✂️ Proposed direction
-**Turn 3 — Implement.** Write tests following these rules: -... -After writing tests, run `snforge test` to verify they pass. If any fail, fix and re-run. +**Turn 3 — Implement.** +- Follow implementation standards in [workflows/default.md](workflows/default.md). +- Use detailed test patterns and cheatcode/fuzz guidance in [references/legacy-full.md](references/legacy-full.md). +- Keep generated tests aligned with Security-Critical Rules below.As per coding guidelines, "Keep SKILL.md concise; details go in
references/andworkflows/subdirectories".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-testing/SKILL.md` around lines 90 - 113, The "Turn 3 — Implement." block in SKILL.md is too procedural and should be trimmed to a policy-level summary; move the detailed step-by-step rules (Structure rules, Coverage rules, Cheatcode rules, Fuzz rules and exact commands like `snforge test`) into new reference/workflow docs (e.g., workflows/default.md and references/*) and replace the SKILL.md section with a short summary pointing to those files; specifically extract the concrete rules and examples and create entries in workflows/default.md and references/testing.md, update SKILL.md to a one-paragraph policy that references those new files, and ensure links to the new locations are added and any duplicate text in SKILL.md is removed.
13-13:⚠️ Potential issue | 🟡 MinorReplace non-standard phrasing in role definition.
“needs tested” is non-standard here; use “needs to be tested” for clarity and consistency.
📝 Proposed fix
-You are a Cairo testing assistant. Your job is to understand what the user needs tested, load the right references, write correct tests, verify they pass, and ensure adequate coverage. +You are a Cairo testing assistant. Your job is to understand what the user needs to be tested, load the right references, write correct tests, verify they pass, and ensure adequate coverage.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-testing/SKILL.md` at line 13, Update the role definition sentence that reads "Your job is to understand what the user needs tested" to use standard phrasing by changing it to "Your job is to understand what the user needs to be tested" in the SKILL.md content (the sentence beginning "You are a Cairo testing assistant. Your job is to understand...").cairo-optimization/SKILL.md (2)
32-33:⚠️ Potential issue | 🟠 MajorUse
{skill_dir}-qualified script paths consistently in SKILL commands.Lines 33, 66, 114, and 117 still assume cwd inside
cairo-optimization/, which makes orchestration brittle from repo root.Based on learnings, "Use `{skill_dir}` consistently in runnable commands."Proposed fix
-2. Profile hot paths with `python3 scripts/profile.py profile`. +2. Profile hot paths with `python3 {skill_dir}/scripts/profile.py profile`. @@ -(d) Profile the baseline. Run `python3 scripts/profile.py profile` with the appropriate arguments. Read the output PNG to identify top hotspots by steps. +(d) Profile the baseline. Run `python3 {skill_dir}/scripts/profile.py profile` with the appropriate arguments. Read the profiler summary artifact to identify top hotspots by steps. @@ -- Always use `python3 scripts/bounded_int_calc.py` to compute bounds — never calculate manually. +- Always use `python3 {skill_dir}/scripts/bounded_int_calc.py` to compute bounds — never calculate manually. @@ -After each optimization, run `snforge test` and `python3 scripts/profile.py profile` to verify improvement. +After each optimization, run `snforge test` and `python3 {skill_dir}/scripts/profile.py profile` to verify improvement.Also applies to: 66-67, 114-117
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` around lines 32 - 33, Update the runnable commands in SKILL.md to use the {skill_dir}-qualified paths instead of assuming cwd; replace occurrences like `snforge test` and `python3 scripts/profile.py profile` with `{skill_dir}/snforge test` and `python3 {skill_dir}/scripts/profile.py profile` (and similarly qualify the other commands mentioned around lines 66 and 114–117) so orchestration works from the repo root.
66-67:⚠️ Potential issue | 🟠 MajorAvoid PNG-dependent hotspot extraction in orchestration text.
Line 66 says to read PNG output, which conflicts with automation-friendly guidance and the updated workflow doc that treats machine-readable summary as the source of truth.
Based on learnings, "The profiling step is not executable with the declared toolset ... consume a textual/machine-readable summary instead of the PNG."Proposed fix
-(d) Profile the baseline. Run `python3 {skill_dir}/scripts/profile.py profile` with the appropriate arguments. Read the output PNG to identify top hotspots by steps. +(d) Profile the baseline. Run `python3 {skill_dir}/scripts/profile.py profile` with the appropriate arguments. Use the machine-readable hotspot summary (table/text/JSON report) as the ranking source of truth; PNG is optional for visualization.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` around lines 66 - 67, Update the "Profile the baseline" step to avoid instructing readers to read a PNG and instead consume the machine-readable/textual summary produced by the profiler; specifically, change the guidance around the "python3 scripts/profile.py profile" invocation so it directs users to parse the profiler's textual or JSON summary output (the machine-readable summary) to identify top hotspots by steps rather than manually inspecting the PNG image.cairo-contract-authoring/SKILL.md (2)
90-90:⚠️ Potential issue | 🟡 MinorUse idiomatic
.is_zero()instead of direct comparison.In Cairo 1, the recommended pattern for ClassHash validation is
.is_zero()rather than direct comparison to0.♻️ Proposed fix
-- Upgrade flows MUST reject zero class hash: `assert!(new_class_hash != 0, "class_hash_zero")` (or equivalent typed `ClassHash` zero-check if the API uses `ClassHash` directly). +- Upgrade flows MUST reject zero class hash: `assert!(!new_class_hash.is_zero(), "Class hash cannot be zero")`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` at line 90, The assertion currently compares new_class_hash to zero directly; replace that comparison with the idiomatic Cairo 1 zero-check by using the is_zero method on the ClassHash value (e.g., call new_class_hash.is_zero()) and negate it in the existing assertion (or use the typed ClassHash is_zero variant if the API exposes ClassHash methods) so the assertion reads that the hash is not zero via is_zero rather than via equality to 0.
88-92:⚠️ Potential issue | 🟡 MinorReorder security rules to match lines 114-118.
The security rules in Turn 3 use a different order than the Security-Critical Rules section (lines 114-118). Consistent ordering within the same file improves readability.
♻️ Proposed reordering to match lines 114-118
*Security rules (mandatory):* +- Timelock checks MUST read time from `get_block_timestamp()`, never from caller arguments. - Every storage-mutating `#[abi(embed_v0)]` impl function or `#[external(v0)]` function MUST have explicit access posture: guarded (`assert_only_owner` / role check) or intentionally public with a comment stating why. +- Upgrade flows MUST reject zero class hash: `assert!(new_class_hash != 0, "class_hash_zero")` (or equivalent typed `ClassHash` zero-check if the API uses `ClassHash` directly). - Constructor MUST validate critical addresses are non-zero: `assert!(!owner.is_zero(), "owner_zero")`. -- Upgrade flows MUST reject zero class hash: `assert!(new_class_hash != 0, "class_hash_zero")` (or equivalent typed `ClassHash` zero-check if the API uses `ClassHash` directly). -- Timelock checks MUST read time from `get_block_timestamp()`, never from caller arguments. - Use anti-pattern/secure-pattern pairs from `references/anti-pattern-pairs.md` — never write the anti-pattern.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 88 - 92, Reorder the five security rule bullets so their sequence matches the Security-Critical Rules section elsewhere in the file: keep the exact wording and references to #[abi(embed_v0)], #[external(v0)], assert_only_owner / role checks, owner.is_zero() constructor check, new_class_hash zero-check (or typed ClassHash check), get_block_timestamp() for timelocks, and the references/anti-pattern-pairs.md guidance, but change only the list order to mirror the Security-Critical Rules section for consistent reading.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-optimization/SKILL.md`:
- Around line 80-143: The SKILL.md file currently contains deep procedural
details (the "Turn 2 — Plan.", "Turn 3 — Optimize.", "Turn 4 — Verify." sections
and "Security-Critical Rules") that should be moved into new reference/workflow
docs; extract the full step-by-step rules and security checklist into dedicated
files (e.g., workflows/optimization_workflow.md and
references/optimization_rules.md), then replace the removed blocks in SKILL.md
with a concise routing-level summary that points to those new docs and
summarizes the high-level process (e.g., "Plan → Optimize → Verify" plus links),
and ensure any unique rule names or identifiers (like DivRem rules, Rule
numbers, BoundedInt rules, and Security-Critical Rules) are preserved and
referenced by name in the new files so callers of functions/sections (e.g., the
optimization process described under "Turn 3 — Optimize.") can find them.
---
Duplicate comments:
In `@cairo-contract-authoring/SKILL.md`:
- Line 90: The assertion currently compares new_class_hash to zero directly;
replace that comparison with the idiomatic Cairo 1 zero-check by using the
is_zero method on the ClassHash value (e.g., call new_class_hash.is_zero()) and
negate it in the existing assertion (or use the typed ClassHash is_zero variant
if the API exposes ClassHash methods) so the assertion reads that the hash is
not zero via is_zero rather than via equality to 0.
- Around line 88-92: Reorder the five security rule bullets so their sequence
matches the Security-Critical Rules section elsewhere in the file: keep the
exact wording and references to #[abi(embed_v0)], #[external(v0)],
assert_only_owner / role checks, owner.is_zero() constructor check,
new_class_hash zero-check (or typed ClassHash check), get_block_timestamp() for
timelocks, and the references/anti-pattern-pairs.md guidance, but change only
the list order to mirror the Security-Critical Rules section for consistent
reading.
In `@cairo-optimization/SKILL.md`:
- Around line 32-33: Update the runnable commands in SKILL.md to use the
{skill_dir}-qualified paths instead of assuming cwd; replace occurrences like
`snforge test` and `python3 scripts/profile.py profile` with
`{skill_dir}/snforge test` and `python3 {skill_dir}/scripts/profile.py profile`
(and similarly qualify the other commands mentioned around lines 66 and 114–117)
so orchestration works from the repo root.
- Around line 66-67: Update the "Profile the baseline" step to avoid instructing
readers to read a PNG and instead consume the machine-readable/textual summary
produced by the profiler; specifically, change the guidance around the "python3
scripts/profile.py profile" invocation so it directs users to parse the
profiler's textual or JSON summary output (the machine-readable summary) to
identify top hotspots by steps rather than manually inspecting the PNG image.
In `@cairo-testing/SKILL.md`:
- Around line 90-113: The "Turn 3 — Implement." block in SKILL.md is too
procedural and should be trimmed to a policy-level summary; move the detailed
step-by-step rules (Structure rules, Coverage rules, Cheatcode rules, Fuzz rules
and exact commands like `snforge test`) into new reference/workflow docs (e.g.,
workflows/default.md and references/*) and replace the SKILL.md section with a
short summary pointing to those files; specifically extract the concrete rules
and examples and create entries in workflows/default.md and
references/testing.md, update SKILL.md to a one-paragraph policy that references
those new files, and ensure links to the new locations are added and any
duplicate text in SKILL.md is removed.
- Line 13: Update the role definition sentence that reads "Your job is to
understand what the user needs tested" to use standard phrasing by changing it
to "Your job is to understand what the user needs to be tested" in the SKILL.md
content (the sentence beginning "You are a Cairo testing assistant. Your job is
to understand...").
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: c0b9986e-aa99-4b09-a2ad-dfef47ff5846
📒 Files selected for processing (5)
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-testing/workflows/default.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (2)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
🧠 Learnings (12)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-optimization/workflows/default.mdcairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-optimization/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Run `python scripts/quality/validate_skills.py` to perform structure validation of skills
Applied to files:
cairo-optimization/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-testing/SKILL.mdcairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-testing/workflows/default.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
🪛 LanguageTool
cairo-testing/SKILL.md
[style] ~13-~13: The double modal “needs tested” is nonstandard (only accepted in certain dialects). Consider “to be tested”.
Context: ...ob is to understand what the user needs tested, load the right references, write corre...
(NEEDS_FIXED)
[style] ~135-~135: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...s both a positive and negative test. 2. Every access-controlled function is tested wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~116-~116: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
cairo-testing/workflows/default.md
[style] ~28-~28: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... path, correct caller, valid inputs). - Write negative tests (`#[should_panic(expecte...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~29-~29: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ....')]for auth failures, bad inputs). - Write event tests usingspy_events+asser...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~30-~30: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...sing spy_events + assert_emitted. - Write fuzz tests with `#[fuzzer(runs: 256, se...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-optimization/SKILL.md
[style] ~48-~48: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...entify hotspots. - arithmetic: User wants to optimize math (DivRem, loops, Poseidon)...
(REP_WANT_TO_VB)
[style] ~50-~50: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...modular arithmetic. - storage: User wants to pack storage fields or reduce slot usag...
(REP_WANT_TO_VB)
[style] ~58-~58: Consider using the more polite verb “ask” (“tell” implies ordering/instructing someone).
Context: ...rge test` — if any test fails, stop and tell the user to fix tests first. (c) Read ...
(TELL_ASK)
[style] ~101-~101: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...p tables instead of pow() (Rule 3). - Use pop_front / for / multi_pop_front...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~105-~105: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecks instead of bitwise ops (Rule 7). - Use the smallest integer type that fits the...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~106-~106: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...er type that fits the range (Rule 8). - Use hades_permutation for 2-input Poseido...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🔇 Additional comments (6)
cairo-testing/workflows/default.md (1)
1-44: Workflow structure and frontmatter look good.Clear phased flow, and this is the right place for execution detail that should stay out of SKILL.md.
cairo-optimization/workflows/default.md (1)
1-4: Good fixes: frontmatter + runnable commands + machine-readable hotspot guidance are now aligned.This segment is clear and executable for orchestration from repo root.
Also applies to: 15-17, 24-25
cairo-contract-authoring/SKILL.md (4)
1-9: LGTM! Frontmatter is complete and compliant.The YAML frontmatter includes all required fields (
nameanddescription) and provides comprehensive metadata. The description clearly scopes the skill's triggers and capabilities.
15-43: LGTM! All required sections are present.The file correctly includes "When to Use", "When NOT to Use", and "Rationalizations to Reject" sections. The rationalizations effectively counter common security shortcuts.
As per coding guidelines, "Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section".
94-96: LGTM! Component wiring is now appropriately concise.The component wiring section correctly defers to
references/legacy-full.mdandworkflows/default.mdfor detailed steps, keeping the SKILL file focused.As per coding guidelines, "Keep SKILL.md concise; details go in
references/andworkflows/subdirectories".
51-136: LGTM! Well-structured orchestration and workflow.The multi-turn workflow (Understand → Plan → Implement → Verify) provides clear guidance. The reference-loading table, security rules, and eval gate requirements are well-defined.
There was a problem hiding this comment.
♻️ Duplicate comments (3)
cairo-contract-authoring/SKILL.md (1)
87-92:⚠️ Potential issue | 🟡 MinorAlign Turn 3 security-rule ordering with Security-Critical Rules section.
The rule order here still differs from Lines 114-118, which makes the same policy appear inconsistent within one file. Please reorder this list to: timelock → access posture → upgrade → constructor → anti-pattern.
♻️ Proposed diff
*Security rules (mandatory):* +- Timelock checks MUST read time from `get_block_timestamp()`, never from caller arguments. - Every storage-mutating `#[abi(embed_v0)]` impl function or `#[external(v0)]` function MUST have explicit access posture: guarded (`assert_only_owner` / role check) or intentionally public with a comment stating why. -- Constructor MUST validate critical addresses are non-zero: `assert!(!owner.is_zero(), "owner_zero")`. - Upgrade flows MUST reject zero class hash: for felt252 APIs use `assert!(new_class_hash != 0, "class_hash_zero")`; for typed `ClassHash` APIs, apply an equivalent non-zero guard before executing upgrade state changes. -- Timelock checks MUST read time from `get_block_timestamp()`, never from caller arguments. +- Constructor MUST validate critical addresses are non-zero: `assert!(!owner.is_zero(), "owner_zero")`. - Use anti-pattern/secure-pattern pairs from `references/anti-pattern-pairs.md` — never write the anti-pattern.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 87 - 92, The list ordering in the Turn 3 security rules must be made consistent with the Security-Critical Rules section: reorder the bullets so they appear in this sequence — "Timelock checks MUST read time from get_block_timestamp()", then "Every storage-mutating `#[abi(embed_v0)]` impl function or `#[external(v0)]` function MUST have explicit access posture", then "Upgrade flows MUST reject zero class hash" (the felt252 `assert!(new_class_hash != 0, "class_hash_zero")` / typed `ClassHash` non-zero guard), then "Constructor MUST validate critical addresses are non-zero" (e.g., `assert!(!owner.is_zero(), "owner_zero")`), and finally "Use anti-pattern/secure-pattern pairs from `references/anti-pattern-pairs.md`"; update the bullet list in SKILL.md to that exact order and keep each rule text unchanged otherwise.cairo-optimization/SKILL.md (2)
52-135: 🛠️ Refactor suggestion | 🟠 MajorMove deep procedural detail out of
SKILL.mdto keep this file concise.The Orchestration section (lines 52-135) contains ~80 lines of highly prescriptive turn-by-turn instructions, rule catalogs, and step-by-step procedures. This violates the conciseness guideline. SKILL.md should provide routing-level guidance, with detailed procedures delegated to
workflows/and rule catalogs toreferences/.As per coding guidelines, "Keep SKILL.md concise; details go in
references/andworkflows/subdirectories".📝 Recommended approach
Extract the detailed content into:
workflows/optimization_workflow.md— the full turn-by-turn process (Turn 1-4 with all substeps)references/optimization_rules.md— the consolidated rule catalog (process rules, arithmetic rules, storage rules, BoundedInt rules, security-critical rules)Then replace lines 52-135 with a concise routing summary (10-15 lines) that:
- Lists the four turns at a high level (Baseline → Plan → Optimize → Verify)
- Points to
workflows/default.mdfor the execution checklist- Points to
references/for rule details- Preserves rule identifiers/numbers so they remain referenceable
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` around lines 52 - 135, The Orchestration section in SKILL.md is too verbose; extract the detailed turn-by-turn procedures and rule catalog into new files and replace the block with a short routing summary: move the full Turn 1-4 process into workflows/optimization_workflow.md and the rule catalog (process/arithmetic/storage/BoundedInt/security rules) into references/optimization_rules.md, then edit SKILL.md's Orchestration block (the "Turn 1 — Baseline" through "Security-Critical Rules" content) to a concise 10–15 line overview that lists the four turns (Baseline, Plan, Optimize, Verify), references workflows/default.md for the checklist, and points to the new references/*.md files for rule details while preserving rule identifiers so existing references to Rules 1–12 and workflows/default.md still resolve.
33-33:⚠️ Potential issue | 🟡 MinorUse
{skill_dir}prefix consistently for script paths.Line 33 still uses
python3 scripts/profile.py profilewithout the{skill_dir}prefix, while lines 66, 114, and 117 correctly use{skill_dir}/scripts/.... This inconsistency makes the Quick Start instructions fail when run from the repository root.🔧 Proposed fix
-2. Profile hot paths with `python3 scripts/profile.py profile`. +2. Profile hot paths with `python3 {skill_dir}/scripts/profile.py profile`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-optimization/SKILL.md` at line 33, Replace the inconsistent script invocation "python3 scripts/profile.py profile" with the `{skill_dir}`-prefixed form used elsewhere (e.g. `{skill_dir}/scripts/profile.py profile`) so Quick Start uses `{skill_dir}/scripts/...` consistently; update the occurrence of that command in SKILL.md to match the other references (`{skill_dir}/scripts/...`) to ensure running from the repo root works.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@cairo-contract-authoring/SKILL.md`:
- Around line 87-92: The list ordering in the Turn 3 security rules must be made
consistent with the Security-Critical Rules section: reorder the bullets so they
appear in this sequence — "Timelock checks MUST read time from
get_block_timestamp()", then "Every storage-mutating `#[abi(embed_v0)]` impl
function or `#[external(v0)]` function MUST have explicit access posture", then
"Upgrade flows MUST reject zero class hash" (the felt252 `assert!(new_class_hash
!= 0, "class_hash_zero")` / typed `ClassHash` non-zero guard), then "Constructor
MUST validate critical addresses are non-zero" (e.g., `assert!(!owner.is_zero(),
"owner_zero")`), and finally "Use anti-pattern/secure-pattern pairs from
`references/anti-pattern-pairs.md`"; update the bullet list in SKILL.md to that
exact order and keep each rule text unchanged otherwise.
In `@cairo-optimization/SKILL.md`:
- Around line 52-135: The Orchestration section in SKILL.md is too verbose;
extract the detailed turn-by-turn procedures and rule catalog into new files and
replace the block with a short routing summary: move the full Turn 1-4 process
into workflows/optimization_workflow.md and the rule catalog
(process/arithmetic/storage/BoundedInt/security rules) into
references/optimization_rules.md, then edit SKILL.md's Orchestration block (the
"Turn 1 — Baseline" through "Security-Critical Rules" content) to a concise
10–15 line overview that lists the four turns (Baseline, Plan, Optimize,
Verify), references workflows/default.md for the checklist, and points to the
new references/*.md files for rule details while preserving rule identifiers so
existing references to Rules 1–12 and workflows/default.md still resolve.
- Line 33: Replace the inconsistent script invocation "python3
scripts/profile.py profile" with the `{skill_dir}`-prefixed form used elsewhere
(e.g. `{skill_dir}/scripts/profile.py profile`) so Quick Start uses
`{skill_dir}/scripts/...` consistently; update the occurrence of that command in
SKILL.md to match the other references (`{skill_dir}/scripts/...`) to ensure
running from the repo root works.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d2b7935c-008d-49f5-9eb3-f0866bcc89a0
📒 Files selected for processing (3)
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.mdcairo-optimization/SKILL.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (2)
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
🧠 Learnings (11)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.mdcairo-contract-authoring/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-contract-authoring/workflows/default.md
🪛 LanguageTool
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~116-~116: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
cairo-optimization/SKILL.md
[style] ~48-~48: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...entify hotspots. - arithmetic: User wants to optimize math (DivRem, loops, Poseidon)...
(REP_WANT_TO_VB)
[style] ~50-~50: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...modular arithmetic. - storage: User wants to pack storage fields or reduce slot usag...
(REP_WANT_TO_VB)
[style] ~58-~58: Consider using the more polite verb “ask” (“tell” implies ordering/instructing someone).
Context: ...rge test` — if any test fails, stop and tell the user to fix tests first. (c) Read ...
(TELL_ASK)
[style] ~101-~101: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...p tables instead of pow() (Rule 3). - Use pop_front / for / multi_pop_front...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~105-~105: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecks instead of bitwise ops (Rule 7). - Use the smallest integer type that fits the...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~106-~106: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...er type that fits the range (Rule 8). - Use hades_permutation for 2-input Poseido...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
cairo-contract-authoring/workflows/default.md
[style] ~20-~20: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ut storage plan: fields, types, maps. - Output component plan: which OZ components, wi...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~21-~21: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...hich OZ components, wiring checklist. - Output events plan: emitted events, event para...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~22-~22: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ts, event params, and trigger points. - Output security posture: for each external fun...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🔇 Additional comments (1)
cairo-contract-authoring/workflows/default.md (1)
1-49: Looks good — phase workflow is consistent and compliant.Frontmatter is present, the phase breakdown is clear, and the plan/verify/handoff steps align with the SKILL contract.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
evals/cases/contract_skill_benchmark.jsonl (1)
77-78:⚠️ Potential issue | 🟡 MinorAdd the missing
split_halfbenchmark pair for the newexternal(v0)auth rule.Lines 77-78 add
set_feecoverage only; the sameexternal(v0)+assert_only_owner(@self)assertion should be benchmarked forsplit_half(secure/insecure) to avoid a rule regression gap.➕ Suggested additions
+{"case_id":"so_auth_external_v0_split_half_guarded","skill_id":"cairo-contract-authoring","security_class":"auth","fixture":"evals/contracts/secure_owned_vault","expected_pass":true,"run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn split_half\\(ref self: ContractState, amount: u128\\) \\{\\s*assert_only_owner\\(`@self`\\);","description":"external(v0) split_half mutator is explicitly owner-guarded"}],"must_not_match":[]} +{"case_id":"io_auth_external_v0_split_half_guarded","skill_id":"cairo-contract-authoring","security_class":"auth","fixture":"evals/contracts/insecure_owned_vault","expected_pass":false,"run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn split_half\\(ref self: ContractState, amount: u128\\) \\{\\s*assert_only_owner\\(`@self`\\);","description":"external(v0) split_half mutator is explicitly owner-guarded"}],"must_not_match":[]}Based on learnings: Detection/remediation changes MUST include eval case updates.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@evals/cases/contract_skill_benchmark.jsonl` around lines 77 - 78, Add the missing split_half benchmark pair that mirrors the existing external(v0) set_fee rule: create two cases (secure and insecure) that assert the pattern "#[external(v0)] fn set_fee(ref self: ContractState, new_fee_bps: u16) { assert_only_owner(`@self`);" for the split_half fixture variants so the new auth rule is covered for both secure and insecure deployments; use the same naming convention as the existing case_ids (e.g., io_auth_external_v0_set_fee_split_half and so_auth_external_v0_set_fee_split_half) and set expected_pass true for the secure case and false for the insecure case, with run_build/run_tests enabled.cairo-contract-authoring/SKILL.md (1)
87-92: 🧹 Nitpick | 🔵 TrivialSecurity rules ordering still differs from lines 114-118.
The security rules in Turn 3 list: access posture → Constructor → Upgrade → Timelock → Anti-pattern. However, the Security-Critical Rules section (lines 114-118) uses: Timelock → access posture → Upgrade → Constructor → Anti-pattern. Consistent ordering within the same file would improve cross-referencing.
♻️ Proposed reordering to match lines 114-118
*Security rules (mandatory):* +- Timelock checks MUST read time from `get_block_timestamp()`, never from caller arguments. - Every storage-mutating `#[abi(embed_v0)]` impl function or `#[external(v0)]` function MUST have explicit access posture: guarded (`assert_only_owner` / role check) or intentionally public with a comment stating why. +- Upgrade flows MUST reject zero class hash: for felt252 APIs use `assert!(new_class_hash != 0, "class_hash_zero")`; for typed `ClassHash` APIs use `assert!(!new_class_hash.is_zero(), "class_hash_zero")` before executing upgrade state changes. - Constructor MUST validate critical addresses are non-zero: `assert!(!owner.is_zero(), "owner_zero")`. -- Upgrade flows MUST reject zero class hash... -- Timelock checks MUST read time from `get_block_timestamp()`... - Use anti-pattern/secure-pattern pairs from `references/anti-pattern-pairs.md` — never write the anti-pattern.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cairo-contract-authoring/SKILL.md` around lines 87 - 92, The bullet list under the "Security rules (mandatory):" header is ordered differently than the "Security-Critical Rules" section; reorder the five bullets so they match the sequence used in lines 114-118 (Timelock checks → access posture → Upgrade flows → Constructor → Anti-pattern/secure-pattern) by rearranging the existing items (access posture, Constructor, Upgrade flows, Timelock checks, Anti-pattern) to that exact order and keep the wording unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cairo-optimization/scripts/profile.py`:
- Line 269: Update the pipeline step counters so they are consistent: change the
final print that currently outputs "[5/5] Exporting hotspot summary:
{os.path.basename(summary_path)}" and every other step-print that uses "/4" to
use "/5" (or alternatively collapse this export into the existing step 4 flow);
locate print statements that format step counters (e.g., the line printing
"[5/5]" referencing summary_path) and update their formatted strings to reflect
"/5" across the script so all steps show the same total.
---
Duplicate comments:
In `@cairo-contract-authoring/SKILL.md`:
- Around line 87-92: The bullet list under the "Security rules (mandatory):"
header is ordered differently than the "Security-Critical Rules" section;
reorder the five bullets so they match the sequence used in lines 114-118
(Timelock checks → access posture → Upgrade flows → Constructor →
Anti-pattern/secure-pattern) by rearranging the existing items (access posture,
Constructor, Upgrade flows, Timelock checks, Anti-pattern) to that exact order
and keep the wording unchanged.
In `@evals/cases/contract_skill_benchmark.jsonl`:
- Around line 77-78: Add the missing split_half benchmark pair that mirrors the
existing external(v0) set_fee rule: create two cases (secure and insecure) that
assert the pattern "#[external(v0)] fn set_fee(ref self: ContractState,
new_fee_bps: u16) { assert_only_owner(`@self`);" for the split_half fixture
variants so the new auth rule is covered for both secure and insecure
deployments; use the same naming convention as the existing case_ids (e.g.,
io_auth_external_v0_set_fee_split_half and
so_auth_external_v0_set_fee_split_half) and set expected_pass true for the
secure case and false for the insecure case, with run_build/run_tests enabled.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: f5fc7bc4-1bf4-4a64-af6a-cbd394fe1207
📒 Files selected for processing (4)
cairo-contract-authoring/SKILL.mdcairo-optimization/scripts/profile.pycairo-optimization/workflows/default.mdevals/cases/contract_skill_benchmark.jsonl
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Greptile Review
- GitHub Check: full-evals
🧰 Additional context used
📓 Path-based instructions (4)
**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
Python code must follow ruff defaults for linting and style
Files:
cairo-optimization/scripts/profile.py
**/cairo-*/SKILL.md
📄 CodeRabbit inference engine (CLAUDE.md)
**/cairo-*/SKILL.md: Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Keep SKILL.md concise; details go inreferences/andworkflows/subdirectories
Files:
cairo-contract-authoring/SKILL.md
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Markdown files must include YAML frontmatter with required fields:
nameanddescription
Files:
cairo-contract-authoring/SKILL.mdcairo-optimization/workflows/default.md
**/evals/**/*.jsonl
📄 CodeRabbit inference engine (CLAUDE.md)
JSONL evaluation files must have one JSON object per line and validate against schemas in
datasets/manifests/anddatasets/normalized/
Files:
evals/cases/contract_skill_benchmark.jsonl
🧠 Learnings (12)
📓 Common learnings
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : For changes in Cairo contracts, verify that all external/public functions have explicit access control
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_benchmark.jsonlcairo-optimization/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Fail if unsafe patterns are detected in Cairo contracts without mitigation documentation
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_benchmark.jsonlcairo-optimization/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Skill files require: 'When to Use', 'When NOT to Use' sections; security skills also require: 'Rationalizations to Reject' section
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/workflows/default.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Flag any new storage variable in Cairo contracts without initialization guard
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_benchmark.jsonl
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/cairo-*/SKILL.md : Keep SKILL.md concise; details go in `references/` and `workflows/` subdirectories
Applied to files:
cairo-contract-authoring/SKILL.mdcairo-optimization/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Detection/remediation changes MUST include eval case updates
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_benchmark.jsonlcairo-optimization/workflows/default.md
📚 Learning: 2026-03-08T13:12:42.932Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-08T13:12:42.932Z
Learning: Refer to SKILL.md as the canonical router for project guidelines and skill definitions
Applied to files:
cairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-08T21:08:11.403Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: coderabbit-custom-pre-merge-checks-unique-id-file-non-traceable-F7F2B60C-1728-4C9A-8889-4F2235E186CA.txt:0-0
Timestamp: 2026-03-08T21:08:11.403Z
Learning: Applies to contracts/**/*.cairo : Verify felt252 operations in Cairo contracts are bounds-checked
Applied to files:
cairo-contract-authoring/SKILL.mdevals/cases/contract_skill_benchmark.jsonl
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: No operational SDK content — only provide correctness, security, and eval-backed guidance
Applied to files:
cairo-contract-authoring/SKILL.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Applies to **/*.md : Markdown files must include YAML frontmatter with required fields: `name` and `description`
Applied to files:
cairo-optimization/workflows/default.md
📚 Learning: 2026-03-12T18:23:36.582Z
Learnt from: CR
Repo: keep-starknet-strange/starknet-skills PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-12T18:23:36.582Z
Learning: Run `python scripts/quality/validate_skills.py` to perform structure validation of skills
Applied to files:
cairo-optimization/workflows/default.md
🪛 LanguageTool
cairo-contract-authoring/SKILL.md
[style] ~49-~49: You have already used this phrasing in nearby sentences. Consider replacing it to add variety to your writing.
Context: ...rst, then modify. - component: User wants to wire or create an OpenZeppelin componen...
(REP_WANT_TO_VB)
[grammar] ~116-~116: Use a hyphen to join words.
Context: ...ted-public. 3. Upgrade flows reject zero class hash inputs before applying state ...
(QB_NEW_EN_HYPHEN)
🔇 Additional comments (10)
cairo-optimization/scripts/profile.py (2)
266-281: LGTM — clean implementation of the summary export step.The function correctly validates the pprof tool, captures output, handles errors with distinct messages, and writes the summary to a file. The timeout of 120 seconds is reasonable for this operation.
353-353: LGTM — proper integration of the summary export into the pipeline.The summary path follows the same naming convention as other outputs, and the step is correctly called after PNG export with the path included in the final summary display.
Also applies to: 384-384, 390-390
cairo-optimization/workflows/default.md (3)
1-4: LGTM — YAML frontmatter now present.The required
nameanddescriptionfields are properly defined.
14-17: LGTM — machine-readable hotspot source specified.The workflow now correctly references the
.summary.txtfile as the canonical hotspot ranking source instead of relying on PNG parsing. This addresses the automation concern.
12-46: LGTM — well-structured phase-based workflow.The 5-phase structure (Baseline → Plan → Optimize → Validate → Lock) provides clear progression with appropriate verification gates. Script paths use
{skill_dir}for repo-root compatibility.cairo-contract-authoring/SKILL.md (5)
1-9: LGTM — complete YAML frontmatter.All required fields (
name,description) are present along with appropriate metadata, keywords, and tool permissions.
15-28: LGTM — required skill sections present.The file includes
When to Use,When NOT to Use, andRationalizations to Rejectsections as required by coding guidelines.Also applies to: 38-43
51-68: LGTM — orchestration section is well-structured and concise.The Turn 1 understanding phase with mode classification and reference lookup table provides clear guidance without excessive detail. Reference paths are properly qualified with
{skill_dir}.
94-96: LGTM — component wiring guidance is now appropriately concise.The section correctly delegates detailed wiring steps to
references/legacy-full.mdandworkflows/default.mdrather than embedding them here.
132-137: LGTM — Eval Gate section enforces test coverage for security rule changes.This ensures that modifications to security rules or references are accompanied by evaluation case updates, aligning with the project learning that "Detection/remediation changes MUST include eval case updates."
Replace passive reference doc with 4-turn orchestration: Turn 1 — Understand: classify request mode, read existing code, load specific references based on request type Turn 2 — Plan: output interface/storage/component/event/security plan, wait for user confirmation Turn 3 — Implement: write code with mandatory security rules, wire OZ components, run scarb build Turn 4 — Verify: re-check security posture, run tests, suggest testing/auditing next steps Adds: mode selection (new/modify/component), reference loading table, non-negotiable security rules, rationalizations to reject section. 60 → 122 lines. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace numbered list with 5-phase structure matching SKILL.md turns: Scope → Design → Implement → Verify → Handoff. Each phase lists concrete actions instead of vague descriptions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Product-page style README with usage examples, 4-turn workflow overview, security rules summary, directory structure, and recommended flow (authoring → testing → auditor). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The trailofbits-authoring-parity CI check requires every SKILL.md to have a ## Quick Start section. Add a concise 5-step quick start. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SKILL.md: 44 → 130 lines. Prescriptive 4-turn orchestrator with mode selection (unit/integration/fuzz/fork/regression), reference loading table, mandatory coverage rules, and cheatcode guidance. workflows/default.md: 18 → 38 lines. 5-phase reference aligned with orchestrator. README.md: New user-facing product page with usage examples, coverage rules, and recommended flow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SKILL.md: 46 → 130 lines. Prescriptive 4-turn orchestrator with mode selection (profile/arithmetic/bounded-int/storage), reference loading table, process rules (one class per commit, re-test, re-profile), and BoundedInt-specific guidance. workflows/default.md: 26 → 36 lines. 5-phase reference aligned with orchestrator (Baseline → Plan → Optimize → Validate → Lock). README.md: New user-facing product page with 12-rule quick reference table, usage examples, and recommended flow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 3 READMEs now follow the same template as cairo-auditor: badges (modes + rules count), usage examples, workflow table, rules table, code examples (testing/optimization), structure tree, recommended flow diagram, and references. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
6d8339e to
52afe6b
Compare
| with open(summary_path, "w", encoding="utf-8") as handle: | ||
| handle.write(result.stdout) |
There was a problem hiding this comment.
Unhandled OSError on file write bypasses documented exit codes
open() and handle.write() can raise OSError/IOError (e.g., permission denied, disk full). When this happens the exception propagates unhandled all the way out of main(), and Python exits with a traceback and a non-deterministic exit code (typically 1). Any CI script that inspects $? to distinguish failure reasons will misinterpret a disk-full error as an argument error (exit code 1), breaking the documented exit-code contract for exit codes 5–7.
Wrap the write in a try/except:
| with open(summary_path, "w", encoding="utf-8") as handle: | |
| handle.write(result.stdout) | |
| try: | |
| with open(summary_path, "w", encoding="utf-8") as handle: | |
| handle.write(result.stdout) | |
| except OSError as exc: | |
| _fail(7, f"Failed to write hotspot summary to {summary_path}: {exc}") |
Prompt To Fix With AI
This is a comment left during a code review.
Path: cairo-optimization/scripts/profile.py
Line: 280-281
Comment:
**Unhandled `OSError` on file write bypasses documented exit codes**
`open()` and `handle.write()` can raise `OSError`/`IOError` (e.g., permission denied, disk full). When this happens the exception propagates unhandled all the way out of `main()`, and Python exits with a traceback and a non-deterministic exit code (typically `1`). Any CI script that inspects `$?` to distinguish failure reasons will misinterpret a disk-full error as an argument error (exit code `1`), breaking the documented exit-code contract for exit codes `5`–`7`.
Wrap the write in a try/except:
```suggestion
try:
with open(summary_path, "w", encoding="utf-8") as handle:
handle.write(result.stdout)
except OSError as exc:
_fail(7, f"Failed to write hotspot summary to {summary_path}: {exc}")
```
How can I resolve this? If you propose a fix, please make it concise.| {"case_id":"gen_math_parity_no_bitwise","skill_id":"cairo-optimization","security_class":"optimization_arithmetic","fixture":"evals/contracts/secure_math_patterns","target_file":"src/lib.cairo","prompt":"Implement parity checks using DivRem and avoid bitwise '& 1' tricks. Keep all existing tests green.","run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"let \\(_half, rem\\) = DivRem::div_rem\\(value, 2\\);","description":"parity helper should use DivRem"}],"must_not_match":[{"path":"src/lib.cairo","pattern":"&\\s*1","description":"parity must not use bitwise-and shortcut"}]} | ||
| {"case_id":"gen_math_loop_equality","skill_id":"cairo-optimization","security_class":"optimization_loops","fixture":"evals/contracts/secure_math_patterns","target_file":"src/lib.cairo","prompt":"Generate loop logic using equality-based termination (while i != n) in helper and contract count functions; avoid less-than loop conditions.","run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"fn count_to\\(n: u32\\) -> u32 \\{[\\s\\S]*while i != n","description":"helper loop must use equality check"},{"path":"src/lib.cairo","pattern":"fn count\\(ref self: ContractState, n: u32\\) \\{[\\s\\S]*while i != n","description":"contract loop must use equality check"}],"must_not_match":[{"path":"src/lib.cairo","pattern":"while i < n","description":"loop must avoid less-than condition"}]} | ||
| {"case_id":"gen_math_contract_split_secure","skill_id":"cairo-optimization","security_class":"optimization_arithmetic","fixture":"evals/contracts/secure_math_patterns","target_file":"src/lib.cairo","prompt":"Write the full secure math file with optimized split_half external: use DivRem and store quotient/remainder; do not regress to direct division/modulus snippets.","run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"fn split_half\\(ref self: ContractState, value: u128\\) \\{[\\s\\S]*?let \\(half, rem\\) = DivRem::div_rem\\(value, 2\\);","description":"split_half external must use DivRem"}],"must_not_match":[{"path":"src/lib.cairo","pattern":"fn split_half\\(ref self: ContractState, value: u128\\)\\s*\\{[^}]{0,320}?let q = value / 2;","description":"split_half must avoid direct division"}]} | ||
| {"case_id":"gen_owned_external_v0_guarded_mutator","skill_id":"cairo-contract-authoring","security_class":"auth","fixture":"evals/contracts/secure_owned_vault","target_file":"src/lib.cairo","prompt":"Generate an OwnedVault where mutating external(v0) entrypoints enforce explicit owner guarding before state writes. Keep signatures unchanged.","run_build":true,"run_tests":true,"must_match":[{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn set_fee\\(ref self: ContractState, new_fee_bps: u16\\) \\{[\\s\\S]*?assert_only_owner\\(@self\\);","description":"external(v0) set_fee must call owner guard"},{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn split_half\\(ref self: ContractState, amount: u128\\) \\{[\\s\\S]*?assert_only_owner\\(@self\\);","description":"external(v0) split_half must call owner guard"}],"must_not_match":[{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn set_fee\\(ref self: ContractState, new_fee_bps: u16\\)\\s*\\{[^}]{0,320}?self\\.fee_bps\\.write","description":"set_fee must not mutate before owner guard"},{"path":"src/lib.cairo","pattern":"#\\[external\\(v0\\)\\]\\s*fn split_half\\(ref self: ContractState, amount: u128\\)\\s*\\{[^}]{0,320}?self\\.[a-zA-Z_][a-zA-Z0-9_]*\\.write","description":"split_half must not mutate before owner guard"}]} |
There was a problem hiding this comment.
split_half must_not_match reproduces the same [^}] nested-brace fragility as set_fee
The newly-added split_half must_not_match entry uses [^}]{0,320}?self\.[a-zA-Z_][a-zA-Z0-9_]*\.write, which stops matching at the first } encountered — identical to the set_fee pattern's known fragility. If a generated split_half contains any nested block before the storage write (e.g., a bounds guard or an if expression), the [^}] class stops there and the pattern never reaches .write, so the eval case would silently pass even for insecure code.
Example that evades detection:
#[external(v0)]
fn split_half(ref self: ContractState, amount: u128) {
if amount > 0 { // ← `}` here ends [^}] scan
self.balance.write(amount); // write-before-guard goes undetected
}
assert_only_owner(@self);
}Apply the same multiline-capable fix suggested for set_fee (e.g., replace [^}]{0,320}? with a lookahead or split into two patterns) to both entries in this case.
Prompt To Fix With AI
This is a comment left during a code review.
Path: evals/cases/contract_skill_generation_eval.jsonl
Line: 13
Comment:
**`split_half` `must_not_match` reproduces the same `[^}]` nested-brace fragility as `set_fee`**
The newly-added `split_half` `must_not_match` entry uses `[^}]{0,320}?self\.[a-zA-Z_][a-zA-Z0-9_]*\.write`, which stops matching at the first `}` encountered — identical to the `set_fee` pattern's known fragility. If a generated `split_half` contains any nested block before the storage write (e.g., a bounds guard or an `if` expression), the `[^}]` class stops there and the pattern never reaches `.write`, so the eval case would silently pass even for insecure code.
Example that evades detection:
```cairo
#[external(v0)]
fn split_half(ref self: ContractState, amount: u128) {
if amount > 0 { // ← `}` here ends [^}] scan
self.balance.write(amount); // write-before-guard goes undetected
}
assert_only_owner(@self);
}
```
Apply the same multiline-capable fix suggested for `set_fee` (e.g., replace `[^}]{0,320}?` with a lookahead or split into two patterns) to both entries in this case.
How can I resolve this? If you propose a fix, please make it concise.1 participant
Summary
Applies the prescriptive orchestrator pattern to 3 skills, unifies all 4 READMEs, and rewrites the root README as a user-first product page.
Skill rewrites (SKILL.md + workflows)
Each SKILL.md now tells Claude exactly what to load, what to check, and in what order. All share the same section structure: When to Use → When NOT → Quick Start → Rationalizations → Mode Selection → Orchestration → Security Rules → References → Workflow.
Unified READMEs (all 4 production skills)
All READMEs now follow the same template:
authoring → testing → optimization → auditorRoot README rewrite
<details>blockChanges
Test plan
## Install & Useheading matches parity check🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
New Features
Tests