Does this skill replace a professional security audit?

No, this skill is designed to help developers identify and fix common vulnerabilities during development. While it follows professional audit workflows, it should be used to harden code before a final manual security audit by experts.

What kind of visual diagrams does the skill provide?

It generates inheritance graphs to identify shadowing issues, function summaries for access control review, and authorization maps to track which roles can write to specific state variables.

Which security tools does this skill integrate with?

The skill primarily utilizes Slither for static analysis, and provides guidance for setting up Echidna for property-based fuzzing and Manticore for formal verification.

Can it detect DeFi-specific risks like flash loan attacks?

Yes, Step 5 of the workflow specifically focuses on manual review areas that automated tools often miss, including oracle manipulation, flash loans, and MEV risks.

Secure Smart Contract Workflow

Name: Secure Smart Contract Workflow
Author: trailofbits

bytrailofbits

•

2,992

•

Security & Testing

Automates the Trail of Bits 5-step secure development process for smart contracts, including vulnerability scanning, architectural visualization, and property-based testing setup.

The Secure Workflow Guide implements the industry-standard Trail of Bits security methodology to help developers harden smart contracts throughout the development lifecycle. This skill guides you through an automated Slither security analysis, validates complex features like upgradeability and ERC conformance, and generates visual diagrams to expose hidden architectural risks. Beyond automation, it assists in documenting critical security properties for fuzzing with Echidna and provides targeted checklists for manual review areas such as MEV, flash loan risks, and oracle manipulation, ensuring a comprehensive security posture before deployment.

Key Features

01Automated Slither vulnerability scanning with 70+ built-in detectors

02Structured documentation of invariants for fuzzing and formal verification

03Visual generation of inheritance graphs and access control maps

042,992 GitHub stars

05Validation of upgradeability risks, ERC specs, and token integrations

06Manual review checklists for privacy, front-running, and DeFi-specific risks

Use Cases

01Visualizing complex contract inheritance and authorization patterns for documentation

02Conducting pre-audit security sweeps during the smart contract development cycle

03Setting up property-based fuzzing infrastructure using Echidna and Manticore

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills secure-workflow-guide

For use in Claude.ai and ChatGPT

Download Skill