Entry Point Analyzer

Systematically identify all state-changing entry points in a smart contract codebase to guide security audits.

Execution in Codex

Use the available file-reading, search, and shell tools. Resolve bundled reference links relative to this SKILL.md, not the audited repository. Slither is optional; use manual inspection if it is unavailable or fails. Report unreadable source or reference files as coverage gaps. Runtime permissions come from the workspace.

When to Use

Use this skill when:

• Starting a smart contract security audit to map the attack surface
• Asked to find entry points, external functions, or audit flows
• Analyzing access control patterns across a codebase
• Identifying privileged operations and role-restricted functions
• Building an understanding of which functions can modify contract state

When NOT to Use

Do NOT use this skill for:

• Vulnerability detection (use audit-context-building or domain-specific-audits)
• Writing exploit POCs (use solidity-poc-builder)
• Code quality or gas optimization analysis
• Non-smart-contract codebases
• Analyzing read-only functions (this skill excludes them)

Scope: State-Changing Functions Only

This skill focuses exclusively on functions that can modify state. Excluded:

Language	Excluded Patterns
Solidity	view, pure functions
Vyper	@view, @pure functions
Solana	Functions without mut account references
Move	Read-only function bodies; visibility alone does not establish mutability
TON	get methods (FunC), read-only receivers (Tact)
CosmWasm	query entry point and its handlers

Include state-changing Move public fun even without entry: Aptos transaction scripts and Sui programmable transaction blocks can reach them. Trace callees when needed to determine state effects, and record signer, capability, and object ownership requirements separately from visibility.