The Code's New Shortcut: How a Claude Plugin Exposes the Security Risks of AI Verbosity in Crypto Audits

The code whispered secrets the audit missed. But in this case, the whisper was too long. Over 1,100 GitHub stars for a plugin that teaches Claude to shut up. The 'i-have-adhd' skill for Claude Code demands the first line be an action. No polite openers. No repetitive summaries. Max five items per list. The developer community has spoken: AI is too verbose. But in crypto security, verbosity carries the details that define exploit paths. This is not a bug report. It is a systemic failure of the audit process itself. Context: AI-assisted smart contract development is now default. Developers use Claude to generate code, review diffs, and even simulate attack vectors. Enter 'i-have-adhd' — a set of 10 system prompt rules designed to strip output down to the executable minimum. Its popularity reveals a deep pain: default LLM responses waste time. But the cryptosphere operates on the edge of errors. A missing disclaimer in a vault’s withdraw function can drain $50 million. The conflict is structural: speed versus completeness. I see this every day as a security audit partner. The industry’s obsession with efficiency has created a blind spot for informational integrity. Core insight: Every one of the 10 rules introduces a vector of omission when applied to security-sensitive code. Rule 1: 'First line must be an action.' In an audit report, the first line should be the critical finding, not a code snippet without context. By skipping context, the action becomes meaningless or dangerous. Rule 3: 'Remove all polite openers and repetitive summaries.' Politeness often contains the disclaimers that protect auditors. 'I cannot guarantee correctness' is a statement of professional integrity, not fluff. Remove it, and the developer assumes the AI’s output is verified. Rule 6: 'If the code compiles, do not mention style warns.' Style warns sometimes mask structural vulnerabilities, like unchecked external calls or missing reentrancy guards. Collateral is a lie; math is the only truth. But math needs precise language. During my audit of the Fairground protocol in 2020, I discovered a reentrancy vulnerability in their staking logic. The bug was hidden in the verbose documentation that the team had written to appear transparent. The verbosity wasn’t fluff—it was the only place the flaw was traceable. Had an AI output been trimmed by 'i-have-adhd', the root cause would have been buried. The plugin assumes efficiency is always desirable. In crypto, the assumption is false. The Terra-Luna collapse was preceded by public warnings in long-form analyses about the algorithmic stablecoin’s yield loops. Those warnings were verbose, but they were accurate. Shortening them would have turned 'unsustainable' into 'theoretically risky,' which VCs ignored anyway. Now consider the contrarian view: the bulls have a point. The plugin’s rules, like ‘Max 5 items per list’, align with human working memory limits. In fast-moving environments—debugging, ad-hoc code generation, or incident response—concision prevents information overload. For a protocol’s emergency pause function, a direct instruction like 'Call contract Pauser at address 0x… with gas limit 200k' is better than a paragraph of theory. The plugin is not intrinsically flawed; the flaw lies in its universal application to security tasks without adaptation. The crypto industry needs not one template, but multiple: one for brainstorming, one for code generation, and one for audit commentary. The latter must retain every caveat. Privacy is not an option; it is a proof. Similarly, detail is not an option in security; it is a proof of due diligence. When audit firms use AI to generate reports, the line between human and machine oversight blurs. 'i-have-adhd' is a canary in the coal mine. It signals that the market demands AI tools that mirror human cognitive shortcuts. But shortcuts in cryptography are called vulnerabilities. The proof is complete; the doubt is obsolete. The question remains: Will the next exploit be caused by an AI that was too verbose to be effective, or by a developer who trusted one that was too direct? Takeaway: The community must stop treating prompt engineering as a one-size-fits-all fix. Every crypto tool that integrates LLMs must test its output against audit-grade criteria. Build a dedicated 'Audit Verbose' skill that preserves disclaimers, lists edge cases by default, and never skips defensive warnings. Until then, the code will keep whispering secrets—and the audit will keep missing them.