Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

secure-workflow-guide — Claude Code skill: review and install

Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill secure-workflow-guide -a claude-code
Open on GitHub

What secure-workflow-guide does

The skill walks smart contract codebases through a structured 5-step security audit. It begins with Slither, parsing results across 70+ built-in detectors to sort findings by severity. If the repository uses proxies or tokens, the assistant triggers targeted tools such as slither-check-upgradeability to test 17 upgrade risks and slither-check-erc for 6 standard interfaces.

Visual inspection comes next. By running Slither print options, the skill generates inheritance graphs to catch C3 linearization issues, alongside maps of function visibility and state variable write permissions. Skipping Slither invalidates the audit: manual code review routinely misses detector patterns embedded in automated tools.

The final phases focus on tests and business logic that scanners overlook. The skill structures invariants for property-based fuzzing in Echidna and symbolic execution in Manticore. It then flags manual review risks, such as MEV exposure and price oracle manipulation.

What it helps with

  • scan smart contracts for vulnerabilities with Slither detectors
  • verify contract conformance against six common ERC specifications
  • render inheritance graphs and state variable authorization maps
  • document invariants for Echidna fuzzing and Manticore verification
  • review contracts for oracle manipulation and flash loan exposure

Example prompts for the agent

  • Run the 5-step Trail of Bits security workflow on this repository
  • Analyze contracts with Slither and triage findings by severity
  • Generate visual inheritance diagrams and inspect upgradeability risks

How to install secure-workflow-guide

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill secure-workflow-guide -a claude-code

2Manually: put the files in place

~/.claude/skills/secure-workflow-guide/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/secure-workflow-guide/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs sarif-parsing trailofbits Processes existing SARIF reports from CodeQL, Semgrep, and other scanners. Use it to filter findings, remove duplicates, or prepare results for CI/CD. Claude Code CX Codex Cursor +1 5,900installs

Similar

code-review agno-team Automated code inspection for style violations, bugs, and best-practice gaps. The skill runs linting, identifies issues, and delivers structured feedback with severity levels. Claude Code CX Codex Cursor +1 472installs pr-workflow tursodatabase Enforces rules for atomic commits, clean PRs, dependency licensing, and secret hygiene. Useful for agents pushing code or running inside CI workflows. Claude Code CX Codex Cursor +1 1,200installs better-auth-security-best-practices better-auth Hardens Better Auth deployments by configuring rate limits, CSRF rules, session caching, and OAuth token encryption. Claude Code CX Codex Cursor +1 47,700installs threat-model-analyst official github Runs STRIDE-A threat modeling for a repository or system. It can also update an earlier report against the current code or a chosen commit. GitHub Copilot 1,500installs agent-owasp-compliance official github Checks an AI agent codebase against the 10 OWASP ASI risks. Use it before production deployment, for security review, or when preparing an audit report. GitHub Copilot 1,500installs verified-agent-identity BillionsNetwork This skill gives an agent an Ethereum DID on the Billions Network and a way through 402 Payment Required responses. Use it when an agent has to prove who owns it or pay for API access. Claude Code CX Codex Cursor +1 8,200installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about secure-workflow-guide

How to install secure-workflow-guide in Claude Code?

Run npx skills add trailofbits/skills --skill secure-workflow-guide -a claude-code in your terminal.

What does secure-workflow-guide do?

It guides developers through a 5-step audit for smart contracts: scans code with Slither, validates ERC compliance, builds inheritance diagrams, and outlines test invariants.

Which testing tools are configured during step four?

The workflow organizes properties for property-based fuzzing in Echidna, symbolic execution in Manticore, and custom Slither checks.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor