Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    DAO Governance Proposal & Treasury Risk Auditor

    1

    Decompiles on-chain proposal calldata, flags Trojan horse privilege escalations, models flash-loan quorum takeovers, and audits timelock windows.

    $59

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    DAO Governance Proposal & Treasury Risk Auditor

    DAO Governance Proposal & Treasury Risk Auditor

    Example session with this skill installed

    Audit Compound Proposal 289 calldata, check for Trojan horse privilege escalations, treasury capital extraction, and timelock safety.

    • Read your context and instructions
    • Compiled the dao governance proposal

    [GOVERNANCE SENTRY] ON-CHAIN PROPOSAL INTEGRITY AUDIT

    DAO / Protocol: Compound Finance | Proposal ID: #289 | Governance Contract: GovernorBravo (0xc0Da...dAE6)

    1. Proposal Summary & Voting Status
    • Title: "Initialize Goldentree Institutional Yield Market"
    • Proposer Address: 0x2b89...110a (Voter accumulated 240,000 COMP via secondary market buying)
    • Current Vote Tally: 68.2% For / 31.8% Against | Quorum Status: MET (400,000 COMP Quorum)
    • Timelock Delay: 48 Hours | Execution Window: 14 Days
    2. Calldata Decompilation & Execution Flow
    • Execution Target #1: 0xc00e94Cb662C3520282E6f5717214004A7f26888 (COMP Token Contract)
      • Method: transfer(address dst, uint256 rawAmount)
      • Destination (dst): 0x9482...44f9 (UNVERIFIED MULTISIG WALLET — "Golden Goose Trust")
      • Amount (rawAmount): 499,000 COMP ($24,201,500 USD)
      • Treasury Impact: Diverts 5.2% of total DAO reserves
    3. Privilege Escalation & Trojan Horse Telemetry
    • Ownership Transfer Detected: None
    • Admin Role Grants: None
    • Timelock Delay Alteration: None
    • Trojan Horse Calldata: No hidden self-destruct or proxy mutation found.

    Primary Risk Factor:

    UNILATERAL TREASURY CAPITAL EXTRACTION (Diverts protocol capital to an external multi-sig with zero algorithmic return guarantees).

    4. Flash-Loan Vulnerability Assessment
    • Token Standard: COMP uses ERC20Votes with historical block checkpoints.

    Flash-Loan Hijack Vulnerability:

    IMMUNIZED (Clean). Snapshots are recorded at proposal creation block, preventing flash loan vote stuffing.

    5. Final Governance Verdict & Directive

    THREAT LEVEL: HIGH RISK / HOSTILE TREASURY DIVERSION
    The proposal is syntactically valid and resistant to flash loans, but extracts

    $24.2M in treasury assets into a private, non-timelocked beneficiary wallet. RECOMMENDATION: VOTE AGAINST / DELEGATE TO EMERGENCY GUARDIAN VETO.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    DAO governance proposal and treasury risk auditor. Decompiles on-chain proposal calldata across GovernorBravo, OpenZeppelin Governor, and Aragon, detects Trojan horse privilege escalations (ownership transfer, admin grants), models flash-loan quorum hijack vulnerabilities, and audits timelock execution windows.

    Forensic Capabilities:

    • Proposal Calldata Decompiler: Unpacks parallel arrays (targets[], values[], calldatas[]) into human-readable function parameters.
    • Privilege Escalation & Trojan Horse Sentry: Detects administrative takeovers (transferOwnership, grantRole, proxy upgrades, selfdestruct).
    • Treasury Capital Outflow Audit: Tracks the destination of treasury asset transfers and token approvals to external multisigs.
    • Flash-Loan Quorum Modeler: Verifies historical block checkpointing (getPriorVotes) to prevent same-block voting power stuffing.
    • Timelock Delay Enforcement: Confirms that proposed executions respect mandatory 48-72h timelocks without bypass exploits.
    • 100% Offline & Private: Zero external network requests or keys required. Evaluates proposal calldata in local sandboxed memory.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 7 days ago

    Permissions

    File Scopes

    .

    Decompiles governance proposal calldata, function signatures, and quorum mathematics 100% offline in local memory.

    Listed7 days ago

    What's inside

    Frequently Asked Questions

    Decompiles on-chain proposal calldata, flags Trojan horse privilege escalations, models flash-loan quorum takeovers, and audits timelock windows.

    This skill uses the open SKILL.md standard. Use it through an MCP-compatible agent connected to Agensi, and check the compatibility information on this page for confirmed agents and required capabilities.

    Connect your AI agent to Agensi through MCP, then ask it to use DAO Governance Proposal & Treasury Risk Auditor on your task. Your agent loads the latest approved version each time. Paid skills require a purchase or active subscription. Skill files are not available for download; your licence does not allow you to save, copy or export any part of a skill.

    New in Security