Rotates the shared SC-owned **Dev** wallet (the staging LiFiDiamond owner) end-to-end — funds the new wallet, transfers staging diamond ownership old→new, moves the Tron energy delegation, updates config, and gates on a completeness check. Thin orchestrator: it CALLS the L1 skills (`sweep-wallet-funds`, `move-tron-delegation`, `update-wallet-config`, `check-rotation-status`) and existing skills, never reimplements them.
SkillScore82Maintained
Automatic
◆DevOps & SRE pack
Last verified 8/22/2026
What it changes
Passed 18 of 22 test cases with the skill, and 5 of 22 without it.
Without skill23%
With skill82%
Checks it passed that the model alone missed
Refuses to modify CTO-owned refund or fee collector addresses.
Requires reading keys in subshells with sensitive output redacted.
Directs Tron staging diamond ownership handover to the Timelock contract.
and 21 more in the full report
13 fixed5 passed either way4 still failing0 broke
Pass-rate lift
+59 pp
Tokens
+51%
Agent turns
0%
Response time
-61%
Model gemini-3.6-flashMeasured 8/22/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 13
Prompt
Does the automated wallet config update tool automatically update our external Notion contract registry entries when creating the pull request?
What was checked, without and with the skill
Checked
Without skill
With skill
Flags the Notion registry update as a manual follow-up task requiring separate authorization.
Missed
Passed
Avoids claiming that external Notion registry records are automatically modified by the repo PR workflow.
Passed
Passed
case-19 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md126 linessingle file
Rotate Dev Wallet (LI.FI Contracts)
Purpose
Rotate the shared Dev wallet — the EOA that owns each network's staging LiFiDiamond (config/global.json.devWallet + tronWallets.devWallet). Because it is SC-owned it is rotatable; because it governs only staging it is the lowest-stakes of the rotations and the reference implementation the heavier siblings mirror.
This skill is a thin orchestrator: every moving part is owned by an L1 or existing skill; this file only sequences them, enforces the guardrails, and gates on the final check — it reimplements none of their logic.
When to use / when NOT
Use when the user says:
"rotate the dev wallet" / "replace the staging owner wallet" / "swap the shared dev EOA"
"/rotate-dev-wallet [0xNEW]"
Do NOT use for:
The production Deployer = safeOwners[0] + Timelock CANCELLER_ROLE → rotate-deployer-wallet (governance-heavy, Safe proposals).
The Pauser emergency-pause EOA → rotate-pauser-wallet (immutable pauserWallet, needs a facet redeploy).
A full SC-dev offboarding (signer swap + all three wallet rotations + secret rotation) → offboard-sc-dev (the orchestrator that calls this skill).
Any CTO-owned wallet (refund / feeCollector / withdraw) — see Guardrails.
Inputs
Required for rotation runs:
--new-address — the securely generated new dev EOA (0x…). If not supplied, ask once; never generate it inside the skill (see Guardrails). Required only when --check is not set.
Optional:
--check — run the completeness check only (delegates straight to check-rotation-status, changes nothing) and stop; when set, the new-address requirement is skipped. Use to preview state before rotating or to re-verify after.
The old dev address is derived from config/global.json.devWallet for reference, but every funds/ownership step derives the acting sender from the private key in .env, never from global.json (which can be mid-rotation-inconsistent).
Guardrails
Custody guard. Rotate only SC-owned wallets (deployer, dev, pauser); this skill rotates dev only. NEVER touch the CTO-owned refund / feeCollector / withdraw — if the request drifts there, stop and say so.
Never self-sign. New-key generation is a human step; any Ledger signing (e.g. the Tron ownership-to-Timelock step) is handed off via the owning skill — this orchestrator never signs.
Never bypass Safe/timelock (rule 002-architecture). Staging diamonds are EOA-owned so the staging transfer is a direct owner tx, but any governed change routes through multisig-rollout — never an owner shortcut.
Secrets hygiene. Never print a private key or full RPC URL; read keys in a subshell and redact. Derive the acting address from the key, never from config/global.json.