New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Code Maturity Assessor

by trailofbits in trailofbits/skills

Scores a smart contract or blockchain codebase across 9 maturity categories with evidence, then delivers a scorecard and a priority-ordered improvement roadmap.

OfficialCC-BY-SA-4.0Auto-check passedSecurity

Install Code Maturity Assessor

skills CLI
$ npx skills add trailofbits/skills --skill code-maturity-assessor -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trailofbits/skills code-maturity-assessor --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/building-secure-contracts/skills/code-maturity-assessor .claude/skills/code-maturity-assessor && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
code-maturity-assessor
GitHub stars
7.4k
Token cost
~1.8k tokens
SKILL.md length
742 words
Files
6 (incl. assets)
Skills in repo
79
Repo updated
First seen
Licence
CC-BY-SA-4.0

At a glance

Scores a smart contract or blockchain codebase across 9 maturity categories with evidence, then delivers a scorecard and a priority-ordered improvement roadmap.

  • Works in 3 steps: Discovery → Analysis → Report
  • Scoring how mature a smart contract project is against a rubric
  • SKILL.md covers Purpose, How This Works, Rating System and The 9 Categories, plus 5 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

The assessment uses the Trail of Bits Code Maturity Evaluation framework in three phases. Discovery maps structure, platform, tests and documentation. Analysis goes through each category (arithmetic, auditing, access controls, complexity, decentralization, documentation, MEV risks, low-level code and testing), searching code, reading key files and asking about processes that code cannot show.

Each category is rated Missing, Weak, Moderate, Satisfactory or Strong using fixed rules, for example any Weak criterion makes the whole category Weak. The report holds an executive summary, a scorecard, detailed analysis with evidence and the roadmap. Supporting files define the assessment criteria, the report format and an example report.

When your agent uses it

  • Scoring how mature a smart contract project is against a rubric
  • Producing a maturity scorecard before an audit or launch
  • Judging how well tested or documented a blockchain codebase is
  • Getting a priority-ordered list of improvements for a contract codebase

Example prompts

  • “Assess the maturity of this Solidity project and give me the scorecard.”
  • “Rate how well documented and tested our protocol is against the Trail of Bits categories.”
  • “Produce an improvement roadmap, ordered by priority, for this contract repo.”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Discovery
  2. Analysis
  3. Report

What it can do on your machine

Read from SKILL.md and the folder at commit 82fe822. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Code Maturity Assessor loads about 1.8k tokens when it runs. Until then it costs about 144 tokens; SKILL.md has 742 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~144
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trailofbits/skills at commit 82fe822, republished under its CC-BY-SA-4.0 licence (© trailofbits). 742 words, ~1,823 tokens.

Download SKILL.mdSave it as .claude/skills/code-maturity-assessor/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
code-maturity-assessor
description
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.

Code Maturity Assessor

Purpose

Systematically assesses codebase maturity using Trail of Bits' 9-category framework. Provides evidence-based ratings and actionable recommendations.

Framework: Building Secure Contracts - Code Maturity Evaluation v0.1.0

How This Works

Phase 1: Discovery

Explores the codebase to understand:

  • Project structure and platform
  • Contract/module files
  • Test coverage
  • Documentation availability
Phase 2: Analysis

For each of 9 categories, I'll:

  • Search the code for relevant patterns
  • Read key files to assess implementation
  • Present findings with file references
  • Ask clarifying questions about processes I can't see in code
  • Determine rating based on criteria
Phase 3: Report

Generates:

  • Executive summary
  • Maturity scorecard (ratings for all 9 categories)
  • Detailed analysis with evidence
  • Priority-ordered improvement roadmap

Rating System

  • Missing (0): Not present/not implemented
  • Weak (1): Several significant improvements needed
  • Moderate (2): Adequate, can be improved
  • Satisfactory (3): Above average, minor improvements
  • Strong (4): Exceptional, only small improvements possible

Rating Logic:

  • ANY "Weak" criteria → Weak
  • NO "Weak" + SOME "Moderate" unmet → Moderate
  • ALL "Moderate" + SOME "Satisfactory" met → Satisfactory
  • ALL "Satisfactory" + exceptional practices → Strong

The 9 Categories

I assess 9 comprehensive categories covering all aspects of code maturity. For detailed criteria, analysis approaches, and rating thresholds, see ASSESSMENT_CRITERIA.md.

Quick Reference:

1. ARITHMETIC

  • Overflow protection mechanisms
  • Precision handling and rounding
  • Formula specifications
  • Edge case testing

2. AUDITING

  • Event definitions and coverage
  • Monitoring infrastructure
  • Incident response planning

3. AUTHENTICATION / ACCESS CONTROLS

  • Privilege management
  • Role separation
  • Access control testing
  • Key compromise scenarios

4. COMPLEXITY MANAGEMENT

  • Function scope and clarity
  • Cyclomatic complexity
  • Inheritance hierarchies
  • Code duplication

5. DECENTRALIZATION

  • Centralization risks
  • Upgrade control mechanisms
  • User opt-out paths
  • Timelock/multisig patterns

6. DOCUMENTATION

  • Specifications and architecture
  • Inline code documentation
  • User stories
  • Domain glossaries

7. TRANSACTION ORDERING RISKS

  • MEV vulnerabilities
  • Front-running protections
  • Slippage controls
  • Oracle security

8. LOW-LEVEL MANIPULATION

  • Assembly usage
  • Unsafe code sections
  • Low-level calls
  • Justification and testing

9. TESTING & VERIFICATION

  • Test coverage
  • Fuzzing and formal verification
  • CI/CD integration
  • Test quality

For complete assessment criteria including what I'll analyze, what I'll ask you, and detailed rating thresholds (WEAK/MODERATE/SATISFACTORY/STRONG), see ASSESSMENT_CRITERIA.md.

Example Output

When the assessment is complete, you'll receive a comprehensive maturity report including:

  • Executive Summary: Overall score, top 3 strengths, top 3 gaps, priority recommendations
  • Maturity Scorecard: Table with all 9 categories rated with scores and notes
  • Detailed Analysis: Category-by-category breakdown with evidence (file:line references)
  • Improvement Roadmap: Priority-ordered recommendations (CRITICAL/HIGH/MEDIUM) with effort estimates

For a complete example assessment report, see EXAMPLE_REPORT.md.

Assessment Process

When invoked, I will:

  1. Explore codebase

    • Find contract/module files
    • Identify test files
    • Locate documentation

  2. Analyze each category

    • Search for relevant code patterns
    • Read key implementations
    • Assess against criteria
    • Collect evidence

  3. Interactive assessment

    • Present my findings with file references
    • Ask about processes I can't see in code
    • Discuss borderline cases
    • Determine ratings together

  4. Generate report

    • Executive summary
    • Maturity scorecard table
    • Detailed category analysis with evidence
    • Priority-ordered improvement roadmap
Show full SKILL.md (283 more words)Show less

Rationalizations (Do Not Skip)

RationalizationWhy It's WrongRequired Action
"Found some findings, assessment complete"Assessment requires evaluating ALL 9 categoriesComplete assessment of all 9 categories with evidence for each
"I see events, auditing category looks good"Events alone don't equal auditing maturityCheck logging comprehensiveness, testing, incident response processes
"Code looks simple, complexity is low"Visual simplicity masks composition complexityAnalyze cyclomatic complexity, dependency depth, state machine transitions
"Not a DeFi protocol, MEV category doesn't apply"MEV extends beyond DeFi (governance, NFTs, games)Verify with transaction ordering analysis before declaring N/A
"No assembly found, low-level category is N/A"Low-level risks include external calls, delegatecall, inline assemblySearch for all low-level patterns before skipping category
"This is taking too long"Thorough assessment requires time per categoryComplete all 9 categories, ask clarifying questions about off-chain processes
"I can rate this without evidence"Ratings without file:line references = unsubstantiated claimsCollect concrete code evidence for every category assessment
"User will know what to improve"Vague guidance = no actionProvide priority-ordered roadmap with specific improvements and effort estimates

Report Format

For detailed report structure and templates, see REPORT_FORMAT.md.

Structure:

  1. Executive Summary

    • Project name and platform
    • Overall maturity (average rating)
    • Top 3 strengths
    • Top 3 critical gaps
    • Priority recommendations

  2. Maturity Scorecard

    • Table with all 9 categories
    • Ratings and scores
    • Key findings notes

  3. Detailed Analysis

    • Per-category breakdown
    • Evidence with file:line references
    • Gaps and improvement actions

  4. Improvement Roadmap

    • CRITICAL (immediate)
    • HIGH (1-2 months)
    • MEDIUM (2-4 months)
    • Effort estimates and impact

Ready to Begin

Estimated Time: 30-40 minutes

I'll need:

  • Access to full codebase
  • Your knowledge of processes (monitoring, incident response, team practices)
  • Context about the project (DeFi, NFT, infrastructure, etc.)

Let's assess this codebase!

© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (assets) in plugins/building-secure-contracts/skills/code-maturity-assessor of trailofbits/skills.

  • SKILL.md
  • agents/openai.yaml
  • assets/trail-of-bits-mark.svg
  • resources/ASSESSMENT_CRITERIA.md
  • resources/EXAMPLE_REPORT.md
  • resources/REPORT_FORMAT.md

Open the folder on GitHubat commit 82fe822

Compare with similar skills

Code Maturity Assessor next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Code Maturity Assessor compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Code Maturity Assessor this skilltrailofbits/skills7.4k—~1.8kAutomated safety check: PassCC-BY-SA-4.0
Solidity AuditorGabson0x/bountyforge443—~3.7kAutomated safety check: PassNone
Solidity Auditorpashov/skills1.2k—~9.9kAutomated safety check: PassMIT
Smart Contract Security Reviewscalus3/scalus105—~4.2kAutomated safety check: PassApache-2.0
Secure Codingtechygarg/lattice198—~1.5kAutomated safety check: PassMIT
Meme Coin Security Auditawarexone/Agentic-Bug-Hunter5.3k1 repos~2.4kAutomated safety check: PassMIT

Similar skills

  • Solidity Auditor

    Gabson0x/bountyforge

    Security audit of Solidity code while you develop. An agent skill from Gabson0x/bountyforge.

    443 GitHub stars~3.7k tokensUpdated 21 days ago
    Backend & APIsAuto-check passed

  • Solidity Auditor

    pashov/skills

    Security audit of Solidity code while you develop. An agent skill from pashov/skills.

    1.2k GitHub stars~9.9k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

  • Smart Contract Security Review

    scalus3/scalus

    Security review for Scalus/Cardano smart contracts. An agent skill from scalus3/scalus.

    105 GitHub stars~4.2k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Secure Coding

    techygarg/lattice

    Apply security-conscious thinking when generating or modifying code.

    198 GitHub stars~1.5k tokensUpdated yesterday
    SecurityAuto-check passed

  • Meme Coin Security Audit

    awarexone/Agentic-Bug-Hunter

    Screens EVM and Solana meme coins for rug pull signs such as hidden mint, honeypot logic and fee tricks, starting with fast kill signals before any code review.

    5.3k GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check passed

  • Code Review Specialist

    luongnv89/claude-howto

    Reviews code for security, performance, quality and maintainability, using a checklist, a finding template and two metrics scripts.

    42k GitHub stars~764 tokensUpdated 7 days ago
    DevelopmentAuto-check passed

More from trailofbits/skills

All 79 skills in this repo

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated 5 days ago
    Auto-check: notes

  • Code Graph Mermaid Diagrams

    trailofbits/skills

    Official

    Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.

    7.4k GitHub stars~1.7k tokensUpdated 5 days ago
    Auto-check passed

  • Trailmark Graph Evolution

    trailofbits/skills

    Official

    Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

    7.4k GitHub stars~3.4k tokensUpdated 5 days ago
    Auto-check passed

  • Let Fate Decide

    trailofbits/skills

    Official

    Draws a 12 Houses tarot spread to break ties when a request is vague or casually delegated, then reads the cards to pick the next step.

    7.4k GitHub stars~2.5k tokensUpdated 5 days ago
    Auto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated 5 days ago
    Auto-check: notes

  • Burp Suite Project Parser

    trailofbits/skills

    Official

    Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.

    7.4k GitHub starsUsed in 3 repos~4.2k tokens
    Auto-check: notes

Categories

Questions about Code Maturity Assessor

What does Code Maturity Assessor do?

Scores a smart contract or blockchain codebase across 9 maturity categories with evidence, then delivers a scorecard and a priority-ordered improvement roadmap. The assessment uses the Trail of Bits Code Maturity Evaluation framework in three phases. Discovery maps structure, platform, tests and documentation.

When should I use Code Maturity Assessor?

Code Maturity Assessor fits situations like: scoring how mature a smart contract project is against a rubric; producing a maturity scorecard before an audit or launch; judging how well tested or documented a blockchain codebase is; getting a priority-ordered list of improvements for a contract codebase.

How do I install Code Maturity Assessor in Claude Code?

Run `npx skills add trailofbits/skills --skill code-maturity-assessor -a claude-code`. Or copy the skill folder (plugins/building-secure-contracts/skills/code-maturity-assessor in trailofbits/skills) into .claude/skills/code-maturity-assessor in your project. Claude Code loads it when a task matches its description.

How do I install Code Maturity Assessor in Codex?

Run `npx skills add trailofbits/skills --skill code-maturity-assessor -a codex`. Or copy the skill folder (plugins/building-secure-contracts/skills/code-maturity-assessor in trailofbits/skills) into .agents/skills/code-maturity-assessor in your project. Codex loads it when a task matches its description.

Can I use Code Maturity Assessor in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills --skill code-maturity-assessor -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-maturity-assessor, .gemini/skills/code-maturity-assessor, .github/skills/code-maturity-assessor and .opencode/skills/code-maturity-assessor in your project.

What does Code Maturity Assessor need to run?

SKILL.md names no scripts, command-line tools or credentials: Code Maturity Assessor is instructions for the agent only.

Does Code Maturity Assessor access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Code Maturity Assessor safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Code Maturity Assessor use?

Code Maturity Assessor is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Code Maturity Assessor use?

About 1.8k tokens (SKILL.md is roughly 7.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Code Maturity Assessor?

Skills that share tags, products or a category with Code Maturity Assessor: Solidity Auditor (Gabson0x/bountyforge, 443 stars), Solidity Auditor (pashov/skills, 1.2k stars), Smart Contract Security Review (scalus3/scalus, 105 stars) and Secure Coding (techygarg/lattice, 198 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Code Maturity Assessor?

trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills, which has 7,400 GitHub stars. The repository holds 79 skills in this directory. The repository was last updated on October 2, 2026.

Source: trailofbits/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.