Skip to content
Get packs

Guide · Agent skill

How to use the Foundry Smart Contract Security Audit agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the auditing-foundry-smart-contract-security agent skill, which turns an AI coding agent into a pre-deployment security reviewer for Solidity contracts built with Foundry. You will learn what the skill does, how to install it from a ZIP file, how to ask for an audit in plain language, and what it needs on your machine. It is written for developers who have not used agent skills before.

Foundry Smart Contract Security Auditmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it so the auditing-foundry-smart-contract-security folder is in ~/.claude/skills/ or your project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills instead.
  2. 2Install the required tools. Install Foundry, Python 3 with slither-analyzer and solc-select, and Aderyn. Install Mythril only if you need symbolic execution on a critical contract.
  3. 3Confirm the project builds. Run forge build in your Foundry project. The analyzers need fresh build artifacts, so fix any compile errors first.
  4. 4Ask the agent for an audit. Describe the contract and your goal in plain language, such as reviewing a vault before a testnet deploy. The agent should pick up the skill from its description.
  5. 5Review the report and gate. Read audit-report.json or the agent's summary. Fix or justify each high or critical finding, failing test, or secret, then check the PASS or FAIL result.
  6. 6Deploy through an encrypted keystore. Import your deploy key with cast wallet import, simulate on a testnet first, and only then broadcast. Keep keys out of .env files and git.

What the skill makes the agent do

Once installed, the agent acts as a security reviewer for a Foundry project before you deploy it. Deployed Ethereum-style contracts cannot be patched, and they often hold real money, so the skill is built to catch problems before launch.

It layers four checks: static analysis with Slither and Aderyn, optional symbolic execution with Mythril, Foundry fuzz and invariant tests, and a manual review checklist covering bugs such as reentrancy and broken access control. It also checks for leaked private keys and pushes you toward an encrypted cast keystore instead of plaintext keys.

  • Static analysis: Slither (90+ detectors) and Aderyn
  • Symbolic execution (optional, slow): Mythril
  • Property-based testing: forge fuzz tests and invariant tests with handlers
  • Manual checklist and key hygiene review
  • Output: a findings report with SWC identifiers and a PASS or FAIL deploy gate

Install the skill from the ZIP file

A skill is a folder containing a SKILL.md file and supporting files. Download the ZIP from this page and unzip it so that the auditing-foundry-smart-contract-security folder sits inside a skills directory.

You can install it for yourself across all projects by placing it in ~/.claude/skills/, or for a single project by placing it in that project's .claude/skills/ folder. If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload the skill
~/.claude/skills/auditing-foundry-smart-contract-security/SKILL.md

Install the tools the skill uses

The skill does not replace the analysis tools; it runs them. You need Foundry (forge, cast, anvil), Python 3 with slither-analyzer and solc-select, and Aderyn. Mythril is optional. Gitleaks is referenced as a companion skill for secret scanning.

The source gives these install routes. Foundry is installed with its own installer, Slither with pip, Aderyn with cargo or npm, and Mythril with pip. Install the Python tools in a virtualenv, especially on externally-managed systems. Your project must compile with forge build before analysis works, because the analyzers need build artifacts.

  • Foundry: run the installer from foundry.paradigm.xyz, then foundryup
  • Slither and solc: pip install slither-analyzer, then solc-select install and solc-select use with your version
  • Aderyn: cargo install aderyn, or npm i -g @cyfrin/aderyn
  • Mythril (optional): pip install mythril
  • Gitleaks: see the companion implementing-secret-scanning-with-gitleaks skill
forge build

Trigger the skill with natural requests

You do not need a special command. The skill is meant to be picked up when your request matches its description, which covers writing, reviewing, testing, or deploying Solidity and Foundry code, and working with forge, cast, anvil, or DeFi code. Ask in plain language and name the contract or the goal.

Good requests say what stage you are at and what you want back. For example, you can ask for a pre-deployment review of a vault before a testnet launch, or ask the agent to triage a Slither report and separate real bugs from false positives.

  • Audit my Foundry project before I deploy it to testnet.
  • Review src/Vault.sol for reentrancy and access control problems.
  • Check whether my deploy script keeps keys in a plaintext .env file.
  • Triage these Slither findings and tell me which ones are false positives.
  • Is my token contract covered by invariant tests?

Run the bundled orchestrator and read the report

The skill includes scripts/agent.py, which runs Slither and Aderyn, combines their results, and writes an audit report. You can run it yourself or let the agent run it. The report lists findings with severity, tool source, location, and remediation, plus a PASS or FAIL gate.

The gate fails on any high or critical static finding, a failing test, a leaked secret, or low coverage on value-moving code. Mythril is added with the --mythril option on a specific file. Treat FAIL as a reason to fix or justify each item, not as noise.

  • Full run: writes audit-report.json
  • Add Mythril to one contract with --mythril
  • Manual steps are also documented: slither, aderyn, forge test, and forge coverage
python3 scripts/agent.py --project . --output audit-report.json

Safety notes: scripts and network

The skill runs scripts, so read scripts/agent.py before you run it on a project you do not fully trust. The source states that the skill does not use the network, but the tools it depends on are installed from the internet, and Foundry, Aderyn, and Mythril install steps are yours to run deliberately.

The skill warns against analyzing untrusted contract code on a machine where funded wallets are unlocked. Keep your deployer key in an encrypted cast keystore, use a separate throwaway wallet for testnet, and prefer a hardware wallet for mainnet admin actions.

  • Read scripts/agent.py before running it on unfamiliar code
  • Do not analyze untrusted code with funded wallets unlocked
  • Import deploy keys once with cast wallet import, not into a plaintext PRIVATE_KEY
  • Simulate deployments before adding --broadcast
cast wallet import deployer --interactive

What people use it for

  • Reviewing a token, vault, or staking contract before a testnet launch to catch reentrancy and access control gaps.
  • Checking a Foundry project for missing invariant tests on functions that move value.
  • Triaging Slither or Aderyn output to separate real bugs from false positives before a release.
  • Checking whether deploy scripts or git-tracked files expose a private key or .env secret.

Frequently asked questions

What is the auditing-foundry-smart-contract-security skill?

It is an agent skill that makes an AI coding agent act as a pre-deployment security reviewer for Solidity contracts in a Foundry project. It runs Slither, Aderyn, optionally Mythril, Foundry tests, and a key-leak check, then gives a PASS or FAIL deploy gate with a report.

How do I install an agent skill like this one?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.

What do I need before I can use this skill?

You need Foundry (forge, cast, anvil), Python 3 with slither-analyzer and solc-select, and Aderyn installed with cargo or npm. Mythril is optional, and gitleaks is referenced as a companion skill. Your project must compile with forge build.

Is this skill free to use?

The source lists the license as Apache-2.0 and does not describe any paid tier. The underlying tools, such as Foundry, Slither, Aderyn, and Mythril, are separate projects with their own installation steps.

Does this replace a professional smart contract audit?

No. The skill is designed for pre-deployment checks by the builder and is not a substitute for an independent professional audit of high-value code. It also does not cover live, already-deployed contracts or incident response.

Does it work with Hardhat, non-Foundry projects, or non-EVM chains?

The source says the workflow does not cover non-Foundry projects or non-EVM chains, so it is aimed at Foundry projects on Ethereum-style chains.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits Solidity developers and small teams who want a structured, repeatable pre-deployment check on a Foundry project that handles tokens, vaults, or DeFi logic. Pick something else if you need an independent audit of high-value code, an incident response on live contracts, or support for Hardhat or non-EVM chains.

Download the skill