# code-maturity-assessor

This skill evaluates smart contracts and blockchain code across nine maturity categories. It produces evidence-backed ratings and a ranked improvement plan.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 7100 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/code-maturity-assessor/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/code-maturity-assessor

## What it does

The skill inspects project structure, contract or module files, tests, and documentation. It then reviews arithmetic, auditing, access controls, complexity, decentralization, documentation, transaction-ordering risks, low-level code, and testing. For each category, it gathers file references and asks about processes that cannot be assessed from code alone.

The report contains an executive summary, ratings for all categories, evidence-based analysis, and a priority-ordered roadmap. Ratings range from Missing to Strong and depend on how the criteria are met. Claims without references to code are unsubstantiated, so the assessment collects concrete evidence as it proceeds.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill code-maturity-assessor -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/code-maturity-assessor/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/code-maturity-assessor/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill code-maturity-assessor -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/code-maturity-assessor/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill code-maturity-assessor -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/code-maturity-assessor/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills code-maturity-assessor
```

2. **Manually: put the files in place**
- File: `.github/skills/code-maturity-assessor/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill code-maturity-assessor -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/building-secure-contracts/skills/code-maturity-assessor
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/code-maturity-assessor/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill code-maturity-assessor -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/code-maturity-assessor/SKILL.md

## When to use it
- rate smart contract maturity against a defined framework
- spot gaps in testing and access controls
- collect code evidence across nine assessment categories
- rank improvements for a blockchain codebase

## Example prompts
- Assess this project's smart contract maturity across every category and produce a scorecard.
- Review access controls and transaction-ordering risks, with file references.
- Rate the testing practices and create a prioritized improvement roadmap.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md