Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →austintgriffith/crops
Use for every Ethereum dApp architecture plan and for reviews of existing systems, trust assumptions, custody, admin keys, pause or upgrade powers, hosted infra (RPC, indexer, paymaster, bundler, frontend host, oracle, sequencer), privacy, identity flows, agent permissions, stablecoin issuer risk, censorship resistance, user exit, and restrictive licenses (BUSL, SSPL). CROPS means Censorship Resistance, Open Source and Free, Privacy, Security.
Passed 21 of 22 test cases with the skill, and 11 of 22 without it.
and 12 more in the full report
10 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Review the following Smart Contract code snippet for reentrancy vulnerabilities and gas optimization: `contract TokenVault { mapping(address => uint) public balances; function withdraw() external { uint amt = balances[msg.sender]; (bool s,) = msg.sender.call{value: amt}(""); balances[msg.sender] = 0; } }`. Identify the code vulnerability and provide a patched contract.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies the reentrancy vulnerability in the withdraw function. | Missed | Passed |
| Updates the balance mapping prior to making the external call. | Missed | Passed |
The instructions your model reads when the skill loads.
CROPS is the Ethereum Foundation's shorthand for the properties Ethereum must preserve: Censorship Resistance, Open Source and Free (as in Freedom), Privacy, Security. This skill turns those values into concrete dApp and smart contract architecture checks.
Source context: The Promise of Ethereum: Introducing the EF Mandate and the EF Mandate PDF.
"It works" is not enough. A dApp or smart contract can compile, pass tests, and demo cleanly while handing users to a censorable frontend, a closed indexer, an invisible RPC dependency, a custodial wallet, or an admin key with total control.
You treat decentralization as only a contract property. The contract may be permissionless while the app depends on a single hosted frontend, API, relayer, paymaster, sequencer, bridge, or wallet vendor. Users experience the whole stack.
You treat verified contracts as an open dApp. Etherscan verification ties bytecode to source for that contract only; Open needs the whole stack public, and Free needs a license the Mandate counts as actually free, not merely source-available (EF Mandate p.13). OSI-permissive or copyleft is the practical bar.
You check privacy after the architecture already leaks data. Before choosing contracts, wallets, RPCs, analytics, indexers, or identity flows, tell the builder which addresses, balances, counterparties, timing data, IP metadata, wallet fingerprints, analytics events, and identity links could be exposed.
You treat security as only code bugs. Reentrancy and oracle manipulation matter, but so do custody, upgrades, admin keys, recovery, emergency powers, approvals, and whether the app still works if the team or vendor disappears.
You list architecture options without their trust tradeoffs. Choices like embedded wallet vs Safe vs EOA, or Vercel vs IPFS, change who can control access, custody, privacy, and user exit. Label each option's CROPS impact and recommend the most CROPS-aligned default.
CROPS applies to every Ethereum dApp, new or existing.
For new builds, start with ship/SKILL.md; it runs the short CROPS Gate. Then perform the full CROPS Review below before finalizing architecture.
For existing dApps or contracts, use this review directly when checking trust assumptions, custody, admin powers, privacy, censorship resistance, user exit, or architecture.
During the full review, focus especially on non-trivial answers on any pillar:
Treat missing facts as findings: unknown owner, host, license, custody, oracle, upgrade authority, or exit path is not a clean result. Infer from the repo and architecture where possible; only ask follow-up questions when the review is blocked.
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.