Guide · Agent skill
How to use the Solidity Security agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The solidity-security skill gives an AI agent a set of smart contract security practices to follow while it writes or reviews Solidity code. Solidity is the language used for contracts on Ethereum-style blockchains. This guide explains what the skill does, how to install it, how to ask for it in plain language, and where it falls short, so you can use it without needing prior experience with agent skills.
Solidity Securitywshobson/agents · MIT Download the skill Quick start
- 1Download the ZIP. Get the solidity-security ZIP from our page. It contains SKILL.md and references/details.md.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. If you use the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Ask for the task in plain words. Describe the contract task, such as writing a withdraw function or reviewing a contract, and mention Solidity.
- 5Check the output yourself. Read the agent's code against the checklist and run your own tests before relying on it.
What the solidity-security skill makes the agent do
When the skill is installed, the agent uses its guidance whenever you are writing smart contracts, auditing existing contracts, or adding security measures to a blockchain application. The skill focuses on preventing well-known vulnerabilities such as reentrancy, integer overflow, and missing access control, and on preparing code for a professional audit.
The skill's reference material walks through vulnerabilities such as reentrancy with a vulnerable example, then a secure version using the Checks-Effects-Interactions pattern. It can also write example Hardhat tests and documentation-style code comments that demonstrate these checks.
- Reentrancy: an attacker calls back into your contract before its state is updated
- Integer overflow and related arithmetic issues
- Access control: making sure only authorised callers can perform sensitive actions
- Documentation-style comments (NatSpec-style tags such as @dev and @notice) to make an audit easier
Install the skill from the ZIP download
Download the solidity-security ZIP from our page. The skill is a folder that contains SKILL.md and references/details.md, so you need to unzip the download to get those files in the right place.
For a personal setup, unzip it into ~/.claude/skills/. To limit the skill to one project, unzip it into that project's .claude/skills/ folder instead. If you use the Claude apps rather than a local setup, you can upload the ZIP under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with natural requests
You do not need a special command. The skill's description tells the agent when to use it: when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications. Ask for what you need in ordinary words and mention Solidity or the contract so the agent knows the context.
If the agent does not seem to apply the checklist, name the skill or the task more directly, for example by saying you want the solidity-security checks applied to a specific contract.
- Review this Solidity contract for reentrancy and access control problems.
- Write a withdraw function for this bank contract that follows Checks-Effects-Interactions.
- Prepare this contract for a professional security audit and add NatSpec comments.
- Write Hardhat tests that show my vault rejects a reentrancy attack.
Example: the Checks-Effects-Interactions withdraw pattern
The skill's main example shows the order of operations that prevents reentrancy. The function checks the balance, updates the state, and only then sends the funds. If the external call happens before the balance is set to zero, an attacker contract can call back in and withdraw again.
Here is the withdraw function from the skill's audit preparation example, with its comments kept as written.
function withdraw(uint256 amount) public { require(amount <= balances[msg.sender], "Insufficient balance"); balances[msg.sender] -= amount; (bool success, ) = msg.sender.call{value: amount}(""); require(success, "Transfer failed"); }What you need and the safety limits
The skill needs a Solidity development environment such as Hardhat, because the example tests use Hardhat and chai. The example tests also use the Ethers.js library. The skill does not run scripts and does not use the network.
The skill is guidance, not a verified analysis tool. It is not a replacement for a professional security audit, and missed bugs can cost real funds. Do not deploy contracts that hold real money based only on this skill's output. The skill also does not cover non-Solidity blockchains or languages, such as Rust-based Solana programs.
- Requires a Solidity environment such as Hardhat, plus Ethers.js for the example tests
- Runs scripts: no
- Uses network: no
- Not a substitute for a professional audit
- Does not cover non-Solidity chains such as Solana
What people use it for
- Writing a new withdraw or transfer function that follows Checks-Effects-Interactions
- Reviewing an existing contract for reentrancy, overflow, and missing access control
- Preparing a contract for a professional audit by adding documentation-style comments
- Creating example Hardhat tests that show an attack being rejected
Frequently asked questions
How do I install the solidity-security skill?
Download the ZIP from our page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
What do I need to use the solidity-security skill?
You need a Solidity development environment such as Hardhat, because the example tests use Hardhat and chai. The example tests also use the Ethers.js library. The skill does not run scripts and does not use the network.
Is the solidity-security skill free?
The skill is published under the MIT licence. The source material does not mention any price, so check the licence text on the original repository for the terms.
Can this skill replace a professional smart contract audit?
No. The skill is guidance, not a verified analysis tool, and it is not a replacement for a professional security audit. Missed bugs can cost real funds, so use it to prepare for an audit rather than as a substitute.
Does the skill work for Solana or Rust contracts?
No. The skill covers Solidity and Ethereum-style blockchains. It does not cover non-Solidity blockchains or languages, such as Rust-based Solana programs.
Why isn't my agent using the solidity-security skill?
Make sure the folder is unzipped in the correct location, either ~/.claude/skills/ or the project's .claude/skills/, or that the ZIP was uploaded in the Claude apps. Then name the task clearly and mention Solidity or the contract, since the skill is triggered by writing, auditing, or securing smart contracts.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you write Solidity and want a security checklist applied as you code, if your team is getting a contract ready for an audit, or if you are learning attack patterns such as reentrancy. Pick something else, or a professional auditor, if you are a non-developer about to deploy contracts holding real money, or if your project uses a non-Solidity chain such as Solana.
Download the skill