Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

guidelines-advisor — Claude Code skill: what it does, how to install

Audits smart contract codebases against Trail of Bits guidelines. It spots upgradeability pitfalls, flawed inheritance, and testing gaps.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill guidelines-advisor -a claude-code
Open on GitHub

What guidelines-advisor does

This skill audits smart contract codebases using Trail of Bits guidelines from the Building Secure Contracts framework. It guides the agent through five clear stages, progressing from project discovery to plain-English specifications and prioritized remediation steps.

The assessment covers eleven distinct areas. It examines on-chain and off-chain workload distribution, contract upgradeability, and storage layout safety under delegatecall proxies. For Solidity code, it checks NatSpec coverage, flags compiler warnings, and inspects inheritance hierarchies.

Generating visual architectural diagrams requires Slither installed locally. All final action items come grouped by severity, from critical blockers down to minor code improvements.

What it helps with

  • audit delegatecall proxies and upgradeability patterns
  • identify missing NatSpec tags and specification gaps
  • evaluate contract inheritance depth and function composition
  • spot weaknesses in test suite coverage and fuzzing setup

Example prompts for the agent

  • Review this smart contract codebase against Trail of Bits development guidelines.
  • Audit our upgradeable proxy pattern and verify storage layout safety.
  • Draft a plain English system description and check NatSpec completeness.

How to install guidelines-advisor

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill guidelines-advisor -a claude-code

2Manually: put the files in place

~/.claude/skills/guidelines-advisor/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/guidelines-advisor/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

intended-vs-implemented phuryn Audits the gap between documented architecture and actual code boundaries. Catches missed permission checks and untrusted data exposure in AI-built codebases. Claude Code CX Codex Cursor +1 1,800installs thermo-nuclear-review cursor A skill for comprehensive analysis of branch changes: checks code for bugs, broken functionality, security vulnerabilities, and feature-gate leaks. Use when you need thorough review before merge. Claude Code CX Codex Cursor +1 2,700installs learn-reverse-engineering rohitg00 Interactive tutor for reading compiled programs. One lesson per invocation: from file formats and disassembly to symbolic execution and AI-assisted analysis. Requires Python 3.10+ and your own source code. Claude Code CX Codex Cursor +1 425installs mcp-security-audit official github Audits MCP server configurations for exposed secrets, shell injection, mutable package references, and unapproved servers. Use it before changing .mcp.json. GitHub Copilot 1,100installs arize-ai-provider-integration official arize Manage Arize AI integrations for language model providers: create connections, inspect their settings, and update or remove them. Use it when configuring models for Arize evaluators or other Arize features. GitHub Copilot 1,100installs agent-supply-chain official github Checks AI agent plugins, tools, and dependencies with SHA-256 manifests. Use it before promoting a plugin or auditing its files. GitHub Copilot 1,100installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about guidelines-advisor

How to install guidelines-advisor in Claude Code?

Run npx skills add trailofbits/skills --skill guidelines-advisor -a claude-code in your terminal.

What does guidelines-advisor do?

The skill audits smart contracts across eleven areas, including delegatecall safety, inheritance trees, event emission, and dependencies.

How are the findings prioritized?

The skill assigns every finding to one of four priority levels: CRITICAL, HIGH, MEDIUM, or LOW.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor