CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

solidity-security

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/blockchain-web3/skills/solidity-security/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

62%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean and its code is concrete and executable, and it correctly offloads detail to a real, clearly signaled one-level-deep reference file. Its main weakness is the absence of any workflow: for a skill covering writing, auditing, and hardening, it never sequences the steps or points to validation checkpoints such as the vulnerability checklist at the end of references/details.md or the Hardhat tests it includes.

Suggestions

Add a short sequenced workflow for the primary use case, e.g. 'To audit a contract: 1) Read references/details.md, 2) Walk the Common Vulnerabilities Checklist against each external call and state change, 3) Run the Hardhat security tests below against the contract, 4) Report findings mapped to the checklist items.'

Enumerate the sections of references/details.md in the pointer line (Critical Vulnerabilities, Best Practices, Gas Optimization, Common Vulnerabilities Checklist) so Claude can navigate straight to the relevant section without reading the whole file.

Trim duplication: the 'Audit Preparation' contract restates the Checks-Effects-Interactions pattern already shown in references/details.md, and the intro sentence plus 'When to Use' bullets restate the frontmatter description — replace these with a pointer and a one-line scope note.

DimensionReasoningScore

Conciseness

The body is mostly lean — no tutorials on concepts Claude already knows, just pointers, a bullet trigger list, and two focused code examples — matching anchor 4's 'efficient; minor instances of over-explanation'. Not 5 because the opening line and the seven 'When to Use' bullets largely restate the frontmatter description, and the CEI-withdrawal example is duplicated in references/details.md; not 3 because there is no real padding or concept-teaching.

4 / 5

Actionability

The Hardhat test block (e.g., `await expect(attackerContract.attack(...)).to.be.revertedWith("ReentrancyGuard: reentrant call")`) and the documented Solidity contract are concrete and executable, matching anchor 4. Not 5 because the examples reference contracts (SecureBank, SecureContract, ReentrancyAttacker) that are not provided in the bundle and there is no command for actually running the tests; not 3 because the code is real, complete, and copy-paste-able rather than pseudocode.

4 / 5

Workflow Clarity

There is no sequence for any use case: the 'When to Use This Skill' bullets enumerate scope (writing, auditing, DeFi) but the body never tells Claude what order to work in — no 'read references/details.md, then walk the checklist, then run the security tests'. This matches anchor 2's 'rough sequence present but many gaps; validation absent' (the bullet list is the rough scope, gaps everywhere). Not 3 because even anchor 3 assumes steps are listed; not 1 because the sections and the reference pointer do impose a minimal, coherent structure.

2 / 5

Progressive Disclosure

The single reference — "Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient." — is one level deep, clearly signaled, and the file exists with substantial detail; the body keeps the bulk appropriately out of SKILL.md, matching anchor 4. Not 5 because the pointer does not preview what details.md contains (Critical Vulnerabilities, Best Practices, Gas Optimization, Checklist), so Claude must open the file blind, and the inline 'Audit Preparation' example partially duplicates reference content; not 3 because structure and signaling are clearly better than 'references present but not clearly signaled'.

4 / 5

Total

14

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly states what the skill does and when to use it, with natural trigger terms and a clearly delimited smart-contract security niche. The only weakness is mild buzzword padding ('Master ... best practices') and a few missing synonymous trigger terms.

DimensionReasoningScore

Specificity

"prevent common vulnerabilities" and "implement secure Solidity patterns" are concrete actions in a named domain, matching anchor 4's 'several specific actions; minor gaps'. Not 5 because 'Master smart contract security best practices' leans on buzzword-level phrasing and the actions are less concrete than anchor 5's fully enumerated capabilities; not 3 because more than 1-2 concrete actions are explicitly listed.

4 / 5

Completeness

Both parts are explicit: the what ("prevent common vulnerabilities and implement secure Solidity patterns") and a concrete when clause ("Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications"), matching anchor 5's pattern of what + concrete trigger phrases. Not 4 because the when clause is already explicit and specific, not merely present.

5 / 5

Trigger Term Quality

Natural user phrases are present — "smart contract", "Solidity", "auditing existing contracts", "blockchain applications" — giving good keyword coverage per anchor 4. Not 5 because common variations users say are missing (e.g., '.sol', 'EVM', 'Web3', 'audit'); not 3 because coverage goes well beyond 'some relevant keywords'.

4 / 5

Distinctiveness Conflict Risk

Smart-contract security is a clear niche anchored by distinctive triggers ("Solidity", "smart contract", "auditing contracts"), so conflict risk with other skills is minimal — anchor 5. Not 4 because the 'blockchain applications' qualifier keeps even the broadest trigger ('implementing security measures') inside the niche.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

wshobson/agents

Path

plugins/blockchain-web3/skills/solidity-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.