Skip to content
Get packs

Foundry Smart Contract Security Audit

Runs pre-deployment security checks on Solidity contracts: static analysis, fuzzing, invariant tests, and key hygiene

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
5 files

What it does

When installed, the agent acts as a security reviewer for Ethereum-style smart contracts (small programs that can hold and move real money) written with the Foundry toolkit. Before a contract is deployed, it runs well-known analysis tools (Slither, Aderyn, optionally Mythril), Foundry fuzz and invariant tests, and a scan for leaked private keys, then walks through a checklist of common bugs such as reentrancy and broken access control. It ends with a PASS/FAIL deployment gate and a report, and it also pushes the developer toward storing deploy keys in an encrypted keystore instead of plaintext files.

Great for

  • Solidity developers preparing a contract for a testnet or mainnet deployment
  • Teams reviewing a Foundry project that handles tokens, vaults, or DeFi logic
  • Engineers triaging Slither or Aderyn findings and separating real bugs from false positives

Skip it if

  • Auditing live, already-deployed contracts or responding to an incident, since the skill is designed for pre-deployment work by the builder (not a substitute for a professional independent audit of high-value code)
  • Non-Foundry projects or non-EVM chains, which the skill's workflow does not cover
  • Running analysis on untrusted contract code on a machine with funded wallets unlocked, which the skill itself warns against

Try asking

  • “Audit my Foundry vault contract before I deploy it to Sepolia”
  • “Run Slither and Aderyn on this project and tell me which findings are real bugs”
  • “Write invariant tests with a handler for my staking contract”
  • “Check my repo for leaked private keys and set up a cast keystore for deployment”
Step-by-step guide: how to use Foundry Smart Contract Security AuditInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the Apache-2.0 licence and an attribution note.

    auditing-foundry-smart-contract-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-foundry-smart-contract-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-foundry-smart-contract-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the bundled scripts/agent.py orchestrator for a single JSON report with a deploy gate, and read the script first since it executes local tools
  • Use testnet and a keystore-based account for the deploy step, and simulate before adding --broadcast
  • Treat the PASS result as a gate, not a guarantee: keep manual review and fuzz coverage in place for value-moving functions

What's inside

  • references/api-reference.md
  • references/secure-deployment-and-keys.md
  • references/vulnerability-checklist.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.