secure-workflow-guide

Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.

1.39x

Quality

56%

Does it follow best practices?

Impact

99%

1.39x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/building-secure-contracts/skills/secure-workflow-guide/SKILL.md

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with a clear five-step workflow, but it delegates all executable commands to a resources/ directory that does not exist, leaving it largely non-actionable with broken progressive disclosure. Validation is framed as goals rather than explicit checkpoints.

Suggestions

Provide the actual Slither and diagram-generation commands inline (or ensure resources/WORKFLOW_STEPS.md and resources/EXAMPLE_REPORT.md exist) so the skill is executable without missing files.

Convert per-step 'Goal' lines into explicit validation checkpoints (e.g., 'Validate: rerun Slither until no high-severity findings remain') to support validate→fix→retry loops.

Remove the duplicated restatement between 'Example Output' and 'What You'll Get', or fold one into the other, to tighten token efficiency.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with headers, bullets, and a rationalizations table, but 'Example Output' and 'What You'll Get' substantially restate the step descriptions already given, and the 'How I Work' list re-enumerates the five steps — more than minor trimming needed.	3 / 5
Actionability	Names specific tools and detectors ('slither-check-upgradeability', 'slither-check-erc', 'Echidna', 'Manticore') but provides no actual commands or executable code, deferring everything to the referenced WORKFLOW_STEPS.md file that does not exist in the bundle.	2 / 5
Workflow Clarity	The five-step sequence is clear and reinforced by the numbered 'How I Work' list and a checklist, but validation checkpoints are stated as goals ('Goal: Clean Slither report') rather than explicit validate→fix→retry gates for this batch scanning workflow.	3 / 5
Progressive Disclosure	The body signals one-level-deep references to resources/WORKFLOW_STEPS.md and resources/EXAMPLE_REPORT.md, but that resources/ directory is absent from the bundle — the references are dead — and the existing assets/ SVG is never referenced.	2 / 5
	Total	10 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, enumerating concrete actions across all five workflow steps, but it omits any explicit 'Use when...' trigger clause, which limits its completeness. Trigger term coverage is good but leans on domain jargon rather than natural user phrasings.

Suggestions

Add an explicit trigger clause such as 'Use when reviewing smart contract security before deployment, auditing a contract, or when the user asks for a Trail of Bits security review' to raise completeness from 3.

Broaden trigger terms with natural user phrasings like 'audit', 'smart contract security', and 'security review' alongside the tool names.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across all five steps — 'Runs Slither scans', 'checks special features (upgradeability/ERC conformance/token integration)', 'generates visual security diagrams', 'helps document security properties for fuzzing/verification', 'reviews manual security areas' — giving comprehensive coverage of the workflow's capabilities.	5 / 5
Completeness	Clearly states the 'what' (all the workflow actions) but has no 'Use when...' or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Includes natural terms users would say ('security review', 'Slither', 'secure development workflow', 'fuzzing/verification') but is jargon-heavy for a niche domain and omits common phrasings like 'audit my contract' or 'smart contract security'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Trail of Bits secure development workflow with Slither, Echidna, Manticore) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 2 missing	Warning

	Total	15 / 16 Passed

Repository: trailofbits/skills
Path: plugins/building-secure-contracts/skills/secure-workflow-guide/SKILL.md
Commit: 7be90d6

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.