Lance is a specialized Web3 security agent designed for high-signal vulnerability discovery and reporting in smart contracts and DeFi protocols.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install lance
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install lance using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Lance: Web3 Vulnerability Hunter?
Lance serves as a rigorous security researcher within the Openclaw Skills library, prioritizing economically meaningful vulnerabilities over speculative notes. It specializes in auditing Solidity repositories, EVM bytecode, and Sui Move packages, ensuring every finding passes through a strict multi-gate validation process involving exploitability and economic feasibility checks.
By leveraging comprehensive Openclaw Skills documentation and specialized scripts, Lance automates the tedious parts of a security audit while maintaining a high bar for report quality. It focuses on identifying an attacker-controlled entry point and a deterministic exploit path before a finding is ever accepted as confirmed, making it an essential tool for protocol developers and bug bounty hunters alike.
Lance: Web3 Vulnerability Hunter Use Cases
- Auditing complex DeFi protocols for reentrancy or oracle manipulation vulnerabilities.
- Reviewing smart contract repositories before mainnet deployment to prevent fund loss.
- Participating in bug bounty programs on platforms like Immunefi, HackenProof, or HackerOne.
- Verifying the security of cross-chain bridge logic and signature replay protections.
- Analyzing EVM bytecode or Sui Move packages for exploitable access control bypasses.
How Lance: Web3 Vulnerability Hunter Works
- Validate the target scope and authorization boundaries using the G0 Scope Gate to ensure all testing is permitted.
- Normalize target formats, including on-chain addresses and local repositories, through the G1 Intake Gate.
- Execute structured detection playbooks tailored for EVM, Sui Move, or specific protocol types to identify potential vulnerabilities.
- Verify exploitability by building deterministic attacker paths and state transitions in the G3 Exploitability Gate.
- Perform economic validation to ensure attacks are profitable and rational in real-world market conditions.
- Eliminate false positives and simulate triage before generating a final, platform-ready security report.
Lance: Web3 Vulnerability Hunter Setup
To integrate Lance into your Openclaw Skills environment, ensure you have the necessary Python environment and repository structure:
# Clone the Lance repository into your skills directory
git clone https://github.com/shaniidev/lance.git
# Install required dependencies for target normalization and report generation
pip install -r requirements.txt
# Verify your setup by running the target normalization script
python scripts/normalize_targets.py --help
Lance: Web3 Vulnerability Hunter Data Schema & Taxonomy
Lance organizes its findings into a structured schema to ensure consistency and triage readiness:
| Field | Description |
|---|---|
| Title | A descriptive name of the identified vulnerability |
| Severity | Classification (Critical, High, Medium, or Low) |
| Confidence | Status of the finding (Confirmed, Probable, or Theoretical) |
| Attack Prerequisites | Conditions required to execute the exploit (e.g., capital, timing) |
| Economic Feasibility | Assessment of capital requirements and profitability |
| Evidence | Concrete proof and reproducible steps for the exploit path |
Lance: Web3 Vulnerability Hunter Advanced Features
- Multi-chain support with specific guidance for EVM, Sui Move, and Cross-Chain Bridges.
- Automated triage simulation using references/triage-simulation.md to mirror real-world bug bounty platform processes.
- Specialized parsing of bug bounty scope files via scripts/parse_web3_scope.py.
- Integration with scoring engines and invariant output adapters for deep protocol integrity analysis.
- Wallet trust boundary analysis for identifying vulnerabilities in signature and authorization flows.
SKILL.md
Loading
Related Openclaw Skills
BugReaper
BugReaper is a senior offensive security agent designed to identify real, exploitable vulnerabilities and generate professional reports for bug bounty platforms.
Agent Telegram Communication
A standardized communication protocol for AI agent teams to send structured status updates and notifications via Telegram.
Async Web Search
A high-performance parallel web search tool using Python's asyncio to retrieve data across multiple queries simultaneously.
Codex Orchestrator
A methodical end-to-end software delivery orchestrator for Codex CLI that manages project lifecycles through strict quality gates and spec-driven development.
Bilibili UP to KB
A powerful tool to convert Bilibili videos and entire creator channels into organized, searchable text-based knowledge bases using local transcription.
Writing Style Iterator
A personalized writing style memory system that automatically learns from your edits to refine AI-generated content over time.
Featured*
