secure-workflow-guide

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, automation, security, smart-contracts, strategy.

What it does

Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill secure-workflow-guide

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/secure-workflow-guide ~/.claude/skills/secure-workflow-guide

Safety box score

Grade B, low risk: 14 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local smart-contract security workflow guide: it reads the project tree, runs Slither-family analysis commands, and helps create fuzzing/verification artifacts. The main blast-radius risks are bounded command execution and writing analysis/test files into the repository; it does not describe network exfiltration, secret access, or privileged system changes.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs local tools such as `slither . --exclude-dependencies`, `slither-check-upgradeability`, `slither-check-erc`, `slither-prop`, and `slither --print ...`, so it has moderate command-execution reach on the user's machine.
Network access	0 (none)	The files do not instruct the agent to fetch remote content or send project data off-machine; the only external references are informational links to Trail of Bits resources.
Filesystem reach	2 (moderate)	Step 4 says to "Create property test contract" and "Configure echidna.yaml", and Step 3 generates diagram files, so the workflow can write new files inside the repo.
Secrets & credentials	0 (none)	There is no request to read tokens, keys, passwords, browser sessions, keychains, or `.env` files.
Privilege & persistence	0 (none)	No sudo, global installs, services, scheduled tasks, or shell/OS setting changes are described.
Instruction hijack surface	0 (none)	The skill contains workflow guidance, but no hidden instructions to ignore safeguards, bypass confirmations, follow fetched remote instructions, or hide actions from the user.
Irreversible actions	0 (none)	It analyzes and reports only; it does not deploy, publish, pay, book, merge, or delete anything.
Transparency	0 (none)	The shipped bundle is plain Markdown/YAML/SVG with no binaries, installers, or decoded-at-runtime payloads, so reviewer opacity is low.

Before installing

Read `resources/WORKFLOW_STEPS.md` and confirm you are comfortable with it running Slither-family commands on the whole repo.
Use a scratch clone if you do not want `echidna.yaml`, test contracts, or diagram files generated in your working tree.
If your repo is large, expect `slither . --exclude-dependencies` to take time and scan every contract source file.

Rated 2026-10-20 by an automated review of 5 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/building-secure-contracts/skills/secure-workflow-guide/SKILL.md
Branch: main
Collection: building-secure-contracts
Updated: 2026-09-19

algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist.