What kind of output should I expect?

You will receive an executive summary, a 0-4 rated scorecard for all categories, detailed analysis with code references, and a prioritized improvement roadmap.

Do I need to provide documentation for the assessment?

While the skill can discover existing documentation, it will ask clarifying questions about your internal processes, monitoring, and incident response to ensure an accurate rating.

Is this only for smart contracts?

While optimized for decentralized systems (including MEV and decentralization risks), its categories like access control, complexity, and testing are applicable to most security-critical codebases.

What framework does this skill use?

It uses the Trail of Bits 'Building Secure Contracts' Code Maturity Evaluation framework, covering 9 comprehensive security and architectural categories.

How long does a full assessment take?

A thorough assessment typically takes 30-40 minutes of interactive analysis to ensure all 9 categories are properly evidenced and rated.

Code Maturity Assessor

Name: Code Maturity Assessor
Author: trailofbits

bytrailofbits

•

2,992

•

Security & Testing

Evaluates codebase security and maturity using the Trail of Bits 9-category framework to provide actionable risk reports.

The Code Maturity Assessor is a specialized security tool that performs a deep-dive analysis of your codebase based on the rigorous Trail of Bits 9-category framework. It systematically evaluates critical areas such as arithmetic safety, access controls, and transaction ordering risks, moving beyond simple linting to provide evidence-based ratings. By combining automated code discovery with interactive clarifying questions, it generates a professional maturity scorecard and a prioritized improvement roadmap, making it an essential companion for developers preparing for audits or seeking to harden their software architecture.

Key Features

012,992 GitHub stars

02Interactive discovery phase to capture off-chain processes and team practices

03Evidence-based scoring with specific file and line-number references

04Prioritized improvement roadmap with effort estimates for identified gaps

05Professional maturity scorecard with 0-4 ratings and executive summaries

06Systematic 9-category evaluation framework including MEV, Arithmetic, and Complexity

Use Cases

01Standardizing security best practices across distributed engineering teams

02Pre-audit readiness assessments for smart contracts and complex protocols

03Identifying architectural technical debt and centralization risks in decentralized systems

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills code-maturity-assessor

For use in Claude.ai and ChatGPT

Download Skill