guidelines-advisor
An agent skill by trailofbits, from trailofbits/skills. Tags: architecture, documentation, security, strategy, testing.
What it does
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill guidelines-advisorOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/guidelines-advisor ~/.claude/skills/guidelines-advisorSafety box score
Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a read-only smart-contract review skill that inspects a codebase and produces best-practice guidance, documentation gaps, and testing/architecture recommendations. Its main exposure is local project inspection and optional use of analysis tools like Slither; it does not ship scripts, touch secrets, or modify the machine.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | It may invoke local analysis tools—"I'll use available tools (Slither, etc.)"—but the shipped files contain no executable scripts or installers. |
| Network access | 0 (none) | The skill files describe no downloads, uploads, remote API calls, or other network activity. |
| Filesystem reach | 1 (low) | It explicitly says it will "explore the codebase," "identify all contract/module files," and "locate test files," which is read-only within the project tree. |
| Secrets & credentials | 0 (none) | There is no instruction to access tokens, keys, passwords, `.env` files, browser sessions, or other credential stores. |
| Privilege & persistence | 0 (none) | The files do not request sudo, global installs, service registration, shell-profile edits, or OS-level configuration changes. |
| Instruction hijack surface | 0 (none) | The text describes its own analysis workflow and does not ask the agent to ignore higher-priority instructions, hide actions, or follow externally fetched content. |
| Irreversible actions | 0 (none) | It only generates recommendations and asks clarifying questions; it does not itself deploy, publish, purchase, or send messages. |
| Transparency | 0 (none) | All shipped content is plain text or SVG; there are no binaries, encoded payloads, or unpinned installer URLs. |
Before installing
- Confirm you only want a read-only review skill; it does not ship any native scripts.
- If you want Slither-generated diagrams, verify Slither is already installed locally.
- Review `resources/ASSESSMENT_AREAS.md` and `resources/EXAMPLE_REPORT.md` so you know the intended scope and output style.
Rated 2026-10-19 by an automated review of 6 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/building-secure-contracts/skills/guidelines-advisor/SKILL.md
- Branch
- main
- Collection
- building-secure-contracts
- Updated
- 2026-09-19
Related skills
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- open-sourcing — This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public".
- secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow.
- address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
- atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.