Master smart contract security with auditing, vulnerability detection, and incident response
Detects critical vulnerabilities like reentrancy and access control issues in smart contracts, then guides systematic audits using Slither, Mythril, and Foundry. Triggered when analyzing Solidity code for security flaws or reviewing contracts for vulnerabilities.
/plugin marketplace add pluginagentmarketplace/custom-plugin-blockchain/plugin install custom-plugin-blockchain@pluginagentmarketplace-blockchainThis skill inherits all available tools. When active, it can use any tool Claude has access to.
assets/config.yamlassets/schema.jsonreferences/GUIDE.mdreferences/PATTERNS.mdscripts/validate.pyMaster smart contract security with vulnerability detection, auditing methodology, and incident response procedures.
# Invoke this skill for security analysis
Skill("smart-contract-security", topic="vulnerabilities", severity="high")
Recognize and prevent:
Systematic review process:
Essential tooling:
Handle security events:
// VULNERABLE
function withdraw(uint256 amount) external {
(bool ok,) = msg.sender.call{value: amount}("");
require(ok);
balances[msg.sender] -= amount; // After call!
}
// FIXED: CEI Pattern
function withdraw(uint256 amount) external {
balances[msg.sender] -= amount; // Before call
(bool ok,) = msg.sender.call{value: amount}("");
require(ok);
}
// VULNERABLE
function setAdmin(address newAdmin) external {
admin = newAdmin; // Anyone can call!
}
// FIXED
function setAdmin(address newAdmin) external onlyOwner {
admin = newAdmin;
}
// VULNERABLE
IERC20(token).transfer(to, amount); // Ignored!
// FIXED: Use SafeERC20
using SafeERC20 for IERC20;
IERC20(token).safeTransfer(to, amount);
// VULNERABLE: Division before multiplication
uint256 fee = (amount / 1000) * rate;
// FIXED: Multiply first
uint256 fee = (amount * rate) / 1000;
# Slither - Fast vulnerability detection
slither . --exclude-dependencies
# Mythril - Symbolic execution
myth analyze src/Contract.sol
# Semgrep - Custom rules
semgrep --config "p/smart-contracts" .
// Foundry fuzz test
function testFuzz_Withdraw(uint256 amount) public {
amount = bound(amount, 1, type(uint128).max);
vm.deal(address(vault), amount);
vault.deposit{value: amount}();
uint256 before = address(this).balance;
vault.withdraw(amount);
assertEq(address(this).balance, before + amount);
}
function invariant_BalancesMatchTotalSupply() public {
uint256 sum = 0;
for (uint i = 0; i < actors.length; i++) {
sum += token.balanceOf(actors[i]);
}
assertEq(token.totalSupply(), sum);
}
| Severity | Impact | Examples |
|---|---|---|
| Critical | Direct fund loss | Reentrancy, unprotected init |
| High | Significant damage | Access control, oracle manipulation |
| Medium | Conditional impact | Precision loss, timing issues |
| Low | Minor issues | Missing events, naming |
# Monitor for suspicious activity
cast logs --address $CONTRACT --from-block latest
// Emergency pause
function pause() external onlyOwner {
_pause();
}
| Pitfall | Risk | Prevention |
|---|---|---|
| Only testing happy path | Missing edge cases | Fuzz test boundaries |
| Ignoring integrations | External call risks | Review all dependencies |
| Trusting block.timestamp | Miner manipulation | Use for long timeframes only |
06-smart-contract-securitysolidity-development, defi-protocols| Version | Date | Changes |
|---|---|---|
| 2.0.0 | 2025-01 | Production-grade with tools, methodology |
| 1.0.0 | 2024-12 | Initial release |
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.