Audit
sablier-labs/evm-monorepo
Security audit and code review for Solidity smart contracts.
Core Solidity design patterns for safe, maintainable smart contracts.
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/solidity-patterns .claude/skills/solidity-patterns && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .claude/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patternsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/solidity-patterns .agents/skills/solidity-patterns && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .agents/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/solidity-patterns .cursor/skills/solidity-patterns && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .cursor/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ccashwell/evm-cortex.git --path skills/solidity-patterns--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/solidity-patterns .gemini/skills/solidity-patterns && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .gemini/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ccashwell/evm-cortex solidity-patternsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/solidity-patterns .github/skills/solidity-patterns && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .github/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/solidity-patterns .opencode/skills/solidity-patterns && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "solidity-patterns" agent skill from https://github.com/ccashwell/evm-cortex/tree/main/skills/solidity-patterns into .opencode/skills/solidity-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "solidity-patterns", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
solidity-patternsCore Solidity design patterns for safe, maintainable smart contracts.
Solidity Patterns is an agent skill from ccashwell/evm-cortex. Core Solidity design patterns for safe, maintainable smart contracts. Use when writing new contracts, reviewing architecture, or refactoring existing protocol code. Covers checks-effects-interactions, pull-over-push, guard checks, state machines, access restriction, and commit-reveal.
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Smart contracts and Design patterns. It works with Solidity. The repository describes itself as: Ethereum protocol engineering squad for AI coding assistants. The licence is MIT.
3 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit f8f3301. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md (its code samples are solidity).
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Solidity Patterns loads about 1.5k tokens when it runs. Until then it costs about 76 tokens; SKILL.md has 196 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from ccashwell/evm-cortex at commit f8f3301, republished under its MIT licence (© ccashwell). 196 words, ~1,544 tokens.
.claude/skills/solidity-patterns/SKILL.md (or your agent's skills folder).The most critical pattern in Solidity. All functions that interact with external contracts must follow this order:
function withdraw(uint256 amount) external {
// CHECKS
if (amount == 0) revert ZeroAmount();
if (balances[msg.sender] < amount) revert InsufficientBalance();
// EFFECTS
balances[msg.sender] -= amount;
// INTERACTIONS
(bool success,) = msg.sender.call{value: amount}("");
if (!success) revert TransferFailed();
emit Withdrawn(msg.sender, amount);
}Violating CEI is the root cause of reentrancy. Even with ReentrancyGuard, always write CEI-compliant code as defense in depth.
Never iterate over recipients to push funds. Let users withdraw (pull) their own funds.
// BAD: Push pattern — one revert blocks everyone
function distributeRewards(address[] calldata recipients, uint256[] calldata amounts) external {
for (uint256 i; i < recipients.length; ++i) {
payable(recipients[i]).transfer(amounts[i]); // reverts if any fails
}
}
// GOOD: Pull pattern — each user claims independently
mapping(address => uint256) public pendingRewards;
function claimReward() external {
uint256 amount = pendingRewards[msg.sender];
if (amount == 0) revert NothingToClaim();
pendingRewards[msg.sender] = 0;
(bool success,) = msg.sender.call{value: amount}("");
if (!success) revert TransferFailed();
emit RewardClaimed(msg.sender, amount);
}Centralize validation in modifiers or internal functions for reuse and consistency.
error Unauthorized();
error InvalidAmount();
error Expired(uint256 deadline);
modifier onlyWhitelisted() {
if (!whitelist[msg.sender]) revert Unauthorized();
_;
}
modifier validAmount(uint256 amount) {
if (amount == 0 || amount > MAX_AMOUNT) revert InvalidAmount();
_;
}
modifier beforeDeadline(uint256 deadline) {
if (block.timestamp > deadline) revert Expired(deadline);
_;
}
function deposit(uint256 amount, uint256 deadline)
external
onlyWhitelisted
validAmount(amount)
beforeDeadline(deadline)
{
// core logic only — all checks in modifiers
}Enforce valid state transitions for multi-phase protocols (auctions, vesting, governance).
enum AuctionState { Created, Bidding, Ended, Settled }
AuctionState public state;
error InvalidState(AuctionState expected, AuctionState actual);
modifier inState(AuctionState expected) {
if (state != expected) revert InvalidState(expected, state);
_;
}
function startBidding() external onlyOwner inState(AuctionState.Created) {
state = AuctionState.Bidding;
emit BiddingStarted(block.timestamp);
}
function endBidding() external onlyOwner inState(AuctionState.Bidding) {
state = AuctionState.Ended;
emit BiddingEnded(block.timestamp);
}
function settle() external inState(AuctionState.Ended) {
state = AuctionState.Settled;
// settlement logic
}Layer access control for different privilege levels.
import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";
contract Treasury is AccessControl {
bytes32 public constant MANAGER_ROLE = keccak256("MANAGER_ROLE");
bytes32 public constant EXECUTOR_ROLE = keccak256("EXECUTOR_ROLE");
uint256 public constant LARGE_THRESHOLD = 100 ether;
function executeSmall(address to, uint256 amount)
external
onlyRole(EXECUTOR_ROLE)
{
if (amount >= LARGE_THRESHOLD) revert ExceedsThreshold();
_transfer(to, amount);
}
function executeLarge(address to, uint256 amount)
external
onlyRole(MANAGER_ROLE)
{
_transfer(to, amount);
}
}Prevent front-running by splitting actions into commit and reveal phases.
struct Commitment {
bytes32 hash;
uint64 timestamp;
bool revealed;
}
mapping(address => Commitment) public commitments;
uint256 public constant REVEAL_WINDOW = 1 hours;
uint256 public constant MIN_COMMIT_AGE = 1 minutes;
function commit(bytes32 hash) external {
commitments[msg.sender] = Commitment({
hash: hash,
timestamp: uint64(block.timestamp),
revealed: false
});
emit Committed(msg.sender, hash);
}
function reveal(uint256 value, bytes32 salt) external {
Commitment storage c = commitments[msg.sender];
if (c.hash == bytes32(0)) revert NoCommitment();
if (c.revealed) revert AlreadyRevealed();
if (block.timestamp < c.timestamp + MIN_COMMIT_AGE) revert TooEarly();
if (block.timestamp > c.timestamp + REVEAL_WINDOW) revert RevealExpired();
bytes32 expected = keccak256(abi.encodePacked(msg.sender, value, salt));
if (c.hash != expected) revert InvalidReveal();
c.revealed = true;
_processReveal(msg.sender, value);
}| Situation | Pattern |
|---|---|
| External calls after state changes | Checks-Effects-Interactions |
| Distributing funds to many users | Pull-over-Push |
| Repeated precondition checks | Guard Check / modifiers |
| Multi-phase protocol flow | State Machine |
| Tiered permissions | Access Restriction |
| Sensitive action prone to front-running | Commit-Reveal |
tx.origin for authorization (phishing vector)transfer() / send() for ETH transfers (2300 gas limit breaks with EIP-1884)© ccashwell, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in skills/solidity-patterns of ccashwell/evm-cortex.
Open the folder on GitHubat commit f8f3301
Solidity Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Solidity Patterns this skillccashwell/evm-cortex | 131 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Auditsablier-labs/evm-monorepo | 353 | — | ~1.8k | Automated safety check: Pass | Custom licence | |
| Foundry Reference Modelaviggiano/security | 144 | — | ~516 | Automated safety check: Pass | MIT | |
| Fizz Convertpashov/skills | 1.2k | 2 repos | ~3.7k | Automated safety check: Pass | MIT | |
| Feynman Auditor0xiehnnkta/nemesis-auditor | 244 | 1 repos | ~11k | Automated safety check: Pass | MIT | |
| Smart Contract Auditgreatpie/smart-contract-audit-skill | 101 | — | ~1.1k | Automated safety check: Pass | None |
sablier-labs/evm-monorepo
Security audit and code review for Solidity smart contracts.
aviggiano/security
Build a simple independent Solidity reference implementation for Foundry tests.
pashov/skills
Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.
0xiehnnkta/nemesis-auditor
Deep business logic bug finder using the Feynman technique. An agent skill from 0xiehnnkta/nemesis-auditor.
greatpie/smart-contract-audit-skill
Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.
Auditware/radar
Use radar for smart contract security analysis, AST generation, and detection template development.
ccashwell/evm-cortex
A skill your agent uses when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview.
ccashwell/evm-cortex
A skill your agent uses when integrating with Aave V3 for lending, borrowing, flash loans, or building on top of Aave markets.
ccashwell/evm-cortex
Access control design patterns for Solidity protocols. An agent skill from ccashwell/evm-cortex.
ccashwell/evm-cortex
A skill your agent uses when running a local Ethereum node with Anvil.
ccashwell/evm-cortex
A skill your agent uses when performing systematic breadth-first review of all contracts during a security audit.
ccashwell/evm-cortex
A skill your agent uses when performing deep analysis of specific findings or high-risk areas during a security audit.
Works with
Categories
Core Solidity design patterns for safe, maintainable smart contracts. Solidity Patterns is an agent skill from ccashwell/evm-cortex. Core Solidity design patterns for safe, maintainable smart contracts.
Solidity Patterns fits situations like: writing new contracts; reviewing architecture; refactoring existing protocol code.
Run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a claude-code`. Or copy the skill folder (skills/solidity-patterns in ccashwell/evm-cortex) into .claude/skills/solidity-patterns in your project. Claude Code loads it when a task matches its description.
Run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a codex`. Or copy the skill folder (skills/solidity-patterns in ccashwell/evm-cortex) into .agents/skills/solidity-patterns in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/solidity-patterns, .gemini/skills/solidity-patterns, .github/skills/solidity-patterns and .opencode/skills/solidity-patterns in your project.
SKILL.md names no scripts, command-line tools or credentials: Solidity Patterns is instructions for the agent only.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Solidity Patterns is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.5k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Solidity Patterns: Audit (sablier-labs/evm-monorepo, 353 stars), Foundry Reference Model (aviggiano/security, 144 stars), Fizz Convert (pashov/skills, 1.2k stars) and Feynman Auditor (0xiehnnkta/nemesis-auditor, 244 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
ccashwell (a GitHub user) maintains it in ccashwell/evm-cortex, which has 131 GitHub stars. The repository holds 89 skills in this directory. The repository was last updated on September 30, 2026.
Source: ccashwell/evm-cortex on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.