code-maturity-assessor

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, blockchain, code-quality, evaluation, security.

What it does

Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill code-maturity-assessor

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/code-maturity-assessor ~/.claude/skills/code-maturity-assessor

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only smart-contract maturity assessor: it reviews repository files, asks about processes, and produces a scorecard. It does not ship executable scripts or networked tooling, so the machine and account risk is very low; the main caveat is that it is opinionated and depends on the assessor to avoid overstating maturity without evidence.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No scripts or code-evaluation tooling are shipped; the skill only says to "Search the code" and "read key files" in `SKILL.md`.
Network access	0 (none)	There is no download, upload, API call, or remote-host interaction described in the shipped files.
Filesystem reach	0 (none)	The skill is analysis-only and mentions reviewing codebase files; it does not instruct edits, deletes, or access outside the project tree.
Secrets & credentials	0 (none)	It does not ask for tokens, passwords, key files, or `.env` access; the only human input it requests is project/process context.
Privilege & persistence	0 (none)	No sudo, service installation, shell startup edits, global installs, or OS/git setting changes are present.
Instruction hijack surface	0 (none)	The text contains no instructions to ignore higher-priority rules, hide behavior, or follow remote content; the "Rationalizations" section is assessment guidance, not prompt injection.
Irreversible actions	0 (none)	The skill produces an evaluation/report only; it does not push, deploy, publish, message, pay, or delete anything.
Transparency	0 (none)	All shipped files are plain-text markdown/YAML/SVG and fully readable; there are no binaries, base64 blobs, or unpinned downloads.

Before installing

Read `SKILL.md` and `resources/ASSESSMENT_CRITERIA.md` to confirm it is analysis-only and matches your review style.
Check that there are no native scripts or installers in the skill folder beyond the documented markdown and asset files.
If you want strict evidence-based scoring, require file:line citations in the final report before using it for decisions.

Rated 2026-10-19 by an automated review of 6 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/building-secure-contracts/skills/code-maturity-assessor/SKILL.md
Branch: main
Collection: building-secure-contracts
Updated: 2026-09-19

dimensional-analysis — Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling.
algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.