Review smart contract security through five steps covering Slither scans, special features, diagrams, documented safety conditions, and manual checks. Get project-specific findings, testing setup guidance, and a prioritized action plan for development or deployment reviews.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Guides through Trail of Bits' secure development workflow - a 5-step process to enhance smart contract security throughout development.
Use this: On every check-in, before deployment, or when you want a security review
Covers a security workflow including:
Run Slither with 70+ built-in detectors to find common vulnerabilities:
Goal: Clean Slither report or documented triages
Detect and validate applicable features:
Note: Only runs checks that apply to your codebase
Generate 3 security diagrams:
Review each diagram for security concerns
Help document critical security properties:
Then set up testing:
Note: Most important activity for security
Analyze areas automated tools miss:
Search codebase for these patterns and flag risks
For detailed instructions, commands, and explanations for each step, see WORKFLOW_STEPS.md.
When invoked, I will:
Adapts based on:
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "Slither not available, I'll check manually" | Manual checking misses 70+ detector patterns | Install and run Slither, or document why it's blocked |
| "Can't generate diagrams, I'll describe the architecture" | Descriptions aren't visual - diagrams reveal patterns text misses | Execute slither --print commands, generate actual visual outputs |
| "No upgrades detected, skip upgradeability checks" | Proxies and upgrades are often implicit or planned | Verify with codebase search before skipping Step 2 checks |
| "Not a token, skip ERC checks" | Tokens can be integrated without obvious ERC inheritance | Check for token interactions, transfers, balances before skipping |
| "Can't set up Echidna now, suggesting it for later" | Property-based testing is Step 4, not optional | Document properties now, set up fuzzing infrastructure |
| "No DeFi interactions, skip oracle/flash loan checks" | DeFi patterns appear in unexpected places (price feeds, external calls) | Complete Step 5 manual review, search codebase for patterns |
| "This step doesn't apply to my project" | "Not applicable" without verification = missed vulnerabilities | Verify with explicit codebase search before declaring N/A |
| "I'll provide generic security advice instead of running workflow" | Generic advice isn't actionable, workflow finds specific issues | Execute all 5 steps, generate project-specific findings with file:line references |
When I complete the workflow, you'll get a comprehensive security report covering:
For a complete example workflow report, see EXAMPLE_REPORT.md.
Security Report:
Action Plan:
Workflow Checklist:
Trail of Bits Resources:
Other Security:
Let me know when you're ready and I'll run through the workflow with your codebase!
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.