solidity-security
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files.
Best use case
solidity-security is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files.
Teams using solidity-security should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/solidity-security/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How solidity-security Compares
| Feature / Agent | solidity-security | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Solidity Security Standards ## Language Rule - **Always respond in the same language the user is using.** If the user asks in Chinese, respond in Chinese. If in English, respond in English. ## Private Key Protection - Store private keys in `.env`, load via `source .env` — never pass keys as CLI arguments - Never expose private keys in logs, screenshots, conversations, or commits - Provide `.env.example` with placeholder values for team reference - Add `.env` to `.gitignore` — verify with `git status` before every commit ## Security Decision Rules When writing or reviewing Solidity code, apply these rules: | Situation | Required Action | |-----------|----------------| | External ETH/token transfer | Use `ReentrancyGuard` + Checks-Effects-Interactions (CEI) pattern | | ERC20 token interaction | Use `SafeERC20` — call `safeTransfer` / `safeTransferFrom`, never raw `transfer` / `transferFrom` | | Owner-only function | Inherit `Ownable2Step` (preferred) or `Ownable` from OZ 4.9.x — `Ownable2Step` prevents accidental owner loss | | Multi-role access | Use `AccessControl` from `@openzeppelin/contracts/access/AccessControl.sol` | | Token approval | Use `safeIncreaseAllowance` / `safeDecreaseAllowance` from `SafeERC20` — never raw `approve` | | Price data needed | Use Chainlink `AggregatorV3Interface` if feed exists; otherwise TWAP with min-liquidity check — never use spot pool price directly | | Upgradeable contract | Prefer UUPS (`UUPSUpgradeable`) over TransparentProxy; always use `Initializable` | | Solidity version < 0.8.0 | Must use `SafeMath` — but strongly prefer upgrading to 0.8.20+ | | Emergency scenario | Inherit `Pausable`, add `whenNotPaused` to user-facing functions; keep admin/emergency functions unpaused | | Whitelist / airdrop | Use `MerkleProof` for gas-efficient verification — never store full address lists on-chain | | Signature-based auth | Use `ECDSA` + `EIP712` — never roll custom signature verification | | Signature content | Signature must bind `chainId` + `nonce` + `msg.sender` + `deadline` — prevent replay and cross-chain reuse | | Cross-chain bridge / third-party dependency | Audit all inherited third-party contract code — never assume dependencies are safe | | Deprecated / legacy contracts | Permanently `pause` or `selfdestruct` deprecated contracts — never leave unused contracts callable on-chain | | UUPS upgrade pattern | `_authorizeUpgrade` must have `onlyOwner`; implementation constructor calls `_disableInitializers()`; retain `onlyProxy` on `upgradeTo` — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[basin H-01](https://code4rena.com/reports/2024-07-basin) | | Multi-contract trust boundary | Router/Registry relay calls must verify source contract authorization; never trust caller identity inside flash loan callbacks — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[noya H-08](https://code4rena.com/reports/2024-04-noya) | | Counter/ID + external call | All counter increments and ID assignments must complete before external calls; ETH refunds must be last — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[phi H-06](https://code4rena.com/reports/2024-08-phi) | ## Reentrancy Protection - All contracts with external calls: inherit `ReentrancyGuard`, add `nonReentrant` modifier - Import: `@openzeppelin/contracts/security/ReentrancyGuard.sol` (OZ 4.9.x) - Always apply CEI pattern even with `ReentrancyGuard`: 1. **Checks** — validate all conditions (`require`) 2. **Effects** — update state variables 3. **Interactions** — external calls last ## Input Validation - Reject `address(0)` for all address parameters - Reject zero amounts for fund transfers - Validate array lengths match when processing paired arrays - Bound numeric inputs to reasonable ranges (prevent dust attacks, gas griefing) ## Gas Control - Deployment commands must include `--gas-limit` (recommended >= 3,000,000) - Monitor gas with `forge test --gas-report` — review before every PR - Configure optimizer in `foundry.toml`: `optimizer = true`, `optimizer_runs = 200` - Avoid unbounded loops over dynamic arrays — use pagination or pull patterns ## Pre-Audit Checklist Before submitting code for review or audit, verify: **Access & Control:** - [ ] All external/public functions have `nonReentrant` where applicable - [ ] No `tx.origin` used for authentication (use `msg.sender`) - [ ] No `delegatecall` to untrusted addresses - [ ] Owner transfer uses `Ownable2Step` (not `Ownable`) to prevent accidental loss - [ ] Contracts with user-facing functions inherit `Pausable` with `pause()` / `unpause()` - [ ] UUPS `_authorizeUpgrade` has `onlyOwner` modifier — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[basin H-01](https://code4rena.com/reports/2024-07-basin) - [ ] Implementation constructor calls `_disableInitializers()` — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[basin H-01](https://code4rena.com/reports/2024-07-basin) - [ ] Router/Registry relay operations verify source contract authorization — [EVMbench](https://cdn.openai.com/evmbench/evmbench.pdf)/[noya H-08](https://code4rena.com/reports/2024-04-noya) **Token & Fund Safety:** - [ ] All ERC20 interactions use `SafeERC20` (`safeTransfer` / `safeTransferFrom`) - [ ] No raw `token.transfer()` or `require(token.transfer())` patterns - [ ] Token approvals use `safeIncreaseAllowance`, not raw `approve` - [ ] All `external call` return values checked **Code Quality:** - [ ] Events emitted for every state change - [ ] No hardcoded addresses — use config or constructor params - [ ] `.env` is in `.gitignore` **Oracle & Price (if applicable):** - [ ] Price data sourced from Chainlink feed or TWAP — never raw spot price - [ ] Oracle has minimum liquidity check — revert if pool reserves too low - [ ] Price deviation circuit breaker in place **Testing:** - [ ] `forge test` passes with zero failures - [ ] `forge coverage` shows adequate coverage on security-critical paths - [ ] Fuzz tests cover arithmetic edge cases (zero, max uint, boundary values) ## Security Verification Commands ```bash # Run all tests with gas report forge test --gas-report # Fuzz testing with higher runs for critical functions forge test --fuzz-runs 10000 # Check test coverage forge coverage # Dry-run deployment to verify no runtime errors forge script script/Deploy.s.sol --fork-url $RPC_URL -vvvv # Static analysis (if slither installed locally) slither src/ ``` ### Slither MCP Integration (if available) When `slither` MCP is configured, prefer it over the CLI for structured analysis: | Approach | When to Use | |---|---| | `slither src/` (CLI) | Quick local scan, raw terminal output | | slither MCP `get_detector_results` | Structured results with impact/confidence filtering, AI can parse and reason about findings | | slither MCP `get_contract_metadata` | Understanding contract structure before reviewing code | | slither MCP `get_function_source` | Locating exact function implementations faster than grep | **Recommended**: Use slither MCP when working with AI agents (results are structured and actionable). Use CLI for quick local checks during development. **Graceful degradation**: If neither slither MCP nor slither CLI is available, rely on the Pre-Audit Checklist above and `forge test --fuzz-runs 10000` for coverage.
Related Skills
checking-session-security
This skill enables Claude to check session security implementations within a codebase. It analyzes session management practices to identify potential vulnerabilities. Use this skill when a user requests to "check session security", "audit session handling", "review session implementation", or asks about "session security best practices" in their code. It helps identify issues like insecure session IDs, lack of proper session expiration, or insufficient protection against session fixation attacks. This skill leverages the session-security-checker plugin. Activates when you request "checking session security" functionality.
performing-security-testing
This skill automates security vulnerability testing. It is triggered when the user requests security assessments, penetration tests, or vulnerability scans. The skill covers OWASP Top 10 vulnerabilities, SQL injection, XSS, CSRF, authentication issues, and authorization flaws. Use this skill when the user mentions "security test", "vulnerability scan", "OWASP", "SQL injection", "XSS", "CSRF", "authentication", or "authorization" in the context of application or API testing.
performing-security-audits
This skill allows Claude to conduct comprehensive security audits of code, infrastructure, and configurations. It leverages various tools within the security-pro-pack plugin, including vulnerability scanning, compliance checking, cryptography review, and infrastructure security analysis. Use this skill when a user requests a "security audit," "vulnerability assessment," "compliance review," or any task involving identifying and mitigating security risks. It helps to ensure code and systems adhere to security best practices and compliance standards.
security-policy-generator
Security Policy Generator - Auto-activating skill for Security Advanced. Triggers on: security policy generator, security policy generator Part of the Security Advanced skill category.
finding-security-misconfigurations
This skill enables Claude to identify potential security misconfigurations in various systems and configurations. It leverages the security-misconfiguration-finder plugin to analyze infrastructure-as-code, application configurations, and system settings, pinpointing common vulnerabilities and compliance issues. Use this skill when the user asks to "find security misconfigurations", "check for security vulnerabilities in my configuration", "audit security settings", or requests a security assessment of a specific system or file. This skill will assist in identifying and remediating potential security weaknesses.
responding-to-security-incidents
Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when needing to respond to a "security incident".
security-headers-generator
Security Headers Generator - Auto-activating skill for Security Fundamentals. Triggers on: security headers generator, security headers generator Part of the Security Fundamentals skill category.
analyzing-security-headers
This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations. It provides a detailed report with a grade, score, and recommendations for improvement. Use this skill when the user asks to "analyze security headers", "check HTTP security", "scan for security vulnerabilities", or requests a "security audit" of a website. It will automatically activate when security-related keywords are used in conjunction with domain names or URLs.
security-group-generator
Security Group Generator - Auto-activating skill for AWS Skills. Triggers on: security group generator, security group generator Part of the AWS Skills skill category.
security-benchmark-runner
Security Benchmark Runner - Auto-activating skill for Security Advanced. Triggers on: security benchmark runner, security benchmark runner Part of the Security Advanced skill category.
scanning-database-security
Process use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".
scanning-container-security
Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".