Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add quillai-network/quillshield_skills --skill behavioral-state-analysisgit clone --depth 1 https://github.com/quillai-network/quillshield_skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/quillai-network/quillshield_skills/behavioral-state-analysis)<a href="https://agentmods.dev/skills/quillai-network/quillshield_skills/behavioral-state-analysis"><img src="https://agentmods.dev/badge/skills/quillai-network/quillshield_skills/behavioral-state-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/quillai-network/quillshield_skills/behavioral-state-analysis"><img src="https://agentmods.dev/badge/skills/quillai-network/quillshield_skills/behavioral-state-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01369 |
| Opus 5 | $0.00027 | $0.00685 |
| Sonnet 5 | $0.00011 | $0.00274 |
| Haiku 4.5 | $0.00005 | $0.00137 |
Grade A, and why
behavioral-state-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Behavioral State Analysis (BSA)
Audit smart contracts by extracting behavioral intent, then systematically breaking it across security dimensions.
When to Use
- Smart contract security audits
- DeFi protocol threat modeling (DEXs, lending, staking, vaults)
- Cross-contract attack surface analysis
- Vulnerability prioritization with confidence scoring
When NOT to Use
- Pure context building (use audit-context-building)
- Entry point identification only (use entry-point-analyzer)
- Single-dimension only (use semantic-guard-analysis or state-invariant-detection)
Token Budget Rules
Follow these strictly to avoid context exhaustion:
- Be terse. Use bullet points and tables, not prose. No filler sentences.
- Smart scope first. Classify the contract type in Phase 1, then run ONLY relevant engines in Phase 2 (see engine selection matrix below).
- Tiered output depth:
- Critical/High findings → full detail + PoC code
- Medium findings → root cause + exploit scenario (no PoC)
- Low/Info findings → one-line description only
- No redundant analysis. If a dimension has no attack surface (e.g., no value flows = skip ETE), say "N/A" and move on.
- Cap Phase 1 output to ≤30 lines per contract. List invariants and states, skip verbose specification documents.
- PoC generation only for Critical and High severity findings. For others, describe the exploit path in ≤3 steps.
- Combine phases in output — don't repeat findings across phases. Each finding appears once with all metadata inline.
Pipeline
Phase 1: Behavioral Decomposition (keep brief)
Extract intent from code and docs. Output per contract:
Contract: <Name>
Type: <DeFi/Token/Governance/NFT/Utility/Proxy>
States: [list]
Key Invariants (≤5):
- <invariant>
Privileged Roles: [list]
Value Entry/Exit Points: [list or "none"]
Then select engines:
| Contract Type | Run ETE | Run ACTE | Run SITE |
|---|---|---|---|
| DeFi (DEX/lending/vault/staking) | Yes | Yes | Yes |
| Token (ERC20/721/1155) | Yes | Lite | Lite |
| Governance/DAO | Lite | Yes | Yes |
| NFT marketplace | Yes | Yes | Lite |
| Utility/Library | No | Lite | Lite |
| Proxy/Upgradeable | No | Yes | Yes |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 135 lines · 54 tokens per session scan A 7cf000936a85
behavioral-state-analysis is a skill published in the GitHub repository quillai-network/quillshield_skills (121 stars, last pushed 5mo ago), licensed MIT. It adds 54 tokens to every session and 1,369 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ansem-crypto
Use when evaluating crypto narratives, attention rotation, memecoin cycles, Solana-style ecosystem momentum, social distribution, and reflexive retail flows in an Ansem-style crypto market framework.
a16z-crypto
Use when evaluating crypto networks and companies through an a16z crypto lens: web3 adoption, infrastructure vs apps, open networks, and long-duration crypto ecosystem investing.
arthur-hayes-liquidity
Use when evaluating crypto markets through an Arthur Hayes-style liquidity lens: dollar liquidity, funding, risk appetite, cycle psychology, and macro-driven crypto positioning.
cobie-cycle-filter
Use when evaluating crypto decisions through a Cobie-style cycle filter: common-sense risk, narrative traps, leverage humility, and avoiding obvious stupid trades.
cryptocred-structure
Use when evaluating crypto charts through a CryptoCred-style structure lens: levels, confluence, market structure, risk definition, and educational technical process.
willy-woo-onchain
Use when evaluating Bitcoin and crypto cycles through a Willy Woo-style on-chain lens: holder behavior, realized value, supply dynamics, and on-chain demand.