analyzing-ethereum-smart-contract-vulnerabilities

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md

Quality

Content

42%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-structured and concise as an overview, but it is not actionable on its own — it lacks concrete commands and fails to link to the detailed reference and script files that would make it executable. The workflow is sequenced but lacks validation checkpoints.

Suggestions

Add concrete, copy-paste-ready commands to each step (e.g. `slither contracts/ --json slither-report.json`, `myth analyze contracts/Token.sol -o json`) or explicitly link to references/api-reference.md from the relevant steps.

Reference the bundle files in the body, e.g. a 'References' section linking to references/api-reference.md and scripts/agent.py, so the overview navigates to the detail.

Insert a validation checkpoint in the triage step (e.g. confirm findings against SWC IDs and filter false positives before reporting) to raise workflow clarity.

Trim the Overview's general background (immutability, loss figures) to tokens that earn their place, since Claude already knows these concepts.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean and well-sectioned, but the Overview explains concepts Claude already knows (immutability of contracts, billions in losses) that could be trimmed; it is efficient overall yet includes some unnecessary explanation.	3 / 5
Actionability	The four steps describe rather than instruct ('Execute Slither', 'Run Mythril') with no concrete commands or code in the body, and the executable CLI examples live only in the unreferenced api-reference.md; minimal concrete guidance is present.	2 / 5
Workflow Clarity	A clear four-step sequence is present (Slither -> Mythril -> triage -> report) but validation/checkpoints are absent and severity triage has no explicit verification, fitting the 'steps listed but validation gaps' anchor.	3 / 5
Progressive Disclosure	The body is well-organized into sections and stays overview-level, but it never links to the provided bundle files (references/api-reference.md, scripts/agent.py), so references are present but not signaled from the overview.	3 / 5
	Total	11 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, clearly conveying what the skill does and the tools used, but it lacks an explicit 'Use when...' trigger clause, capping completeness. Adding natural trigger phrases would round it out.

Suggestions

Append an explicit 'Use when...' clause with natural triggers, e.g. 'Use when auditing Solidity contracts, investigating DeFi exploits, or when the user mentions Slither, Mythril, reentrancy, or .sol files.'

Add common synonyms such as 'audit', 'DeFi', and '.sol files' to broaden trigger-term coverage.

Keep the third-person voice (currently correct) while extending the 'when' guidance to reach full completeness.

Dimension	Reasoning	Score
Specificity	Names both tools (Slither, Mythril), two analysis techniques (static, symbolic), and enumerates concrete vulnerability classes (reentrancy, integer overflow, access control), matching the comprehensive-coverage anchor; not below because coverage is broad rather than having minor gaps.	5 / 5
Completeness	The 'what' is clearly stated (static/symbolic analysis to detect vulnerability classes) but there is no 'Use when...' clause or equivalent trigger guidance, which caps completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural domain terms users say (Solidity, Slither, Mythril, reentrancy, Ethereum) but omits common synonyms like 'audit', 'DeFi', and '.sol', so it sits above a 3 yet short of comprehensive synonym coverage.	4 / 5
Distinctiveness Conflict Risk	Targets a precise niche (Ethereum/Solidity pre-deployment analysis) with named tools and specific vulnerability classes, giving it distinct triggers and minimal overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.