Fizz
pashov/skills
Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects.
Guides through Trail of Bits' 5-step secure development workflow.
Install Secure Workflow Guide
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install trailofbits/skills secure-workflow-guide --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .claude/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .claude/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guideType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install trailofbits/skills secure-workflow-guide --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .agents/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .agents/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install trailofbits/skills secure-workflow-guide --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .cursor/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .cursor/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/trailofbits/skills.git --path plugins/building-secure-contracts/skills/secure-workflow-guide--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install trailofbits/skills secure-workflow-guide --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .gemini/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .gemini/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install trailofbits/skills secure-workflow-guideInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .github/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .github/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add trailofbits/skills --skill secure-workflow-guide -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install trailofbits/skills secure-workflow-guide --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/building-secure-contracts/skills/secure-workflow-guide .opencode/skills/secure-workflow-guide && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "secure-workflow-guide" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide into .opencode/skills/secure-workflow-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "secure-workflow-guide", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
secure-workflow-guide- GitHub stars
- 7.4k
- Token cost
- ~1.7k tokens
- SKILL.md length
- 748 words
- Files
- 5 (incl. assets)
- Skills in repo
- 79
- Repo updated
- First seen
- Licence
- CC-BY-SA-4.0
At a glance
Guides through Trail of Bits' 5-step secure development workflow.
- Works in 5 steps: Check for Known Security Issues → Check Special Features → Visual Security Inspection → …
- Securing a smart contract end to end rather than hunting one bug
- SKILL.md covers Purpose, The 5-Step Workflow, How I Work and Rationalizations (Do Not Skip), plus 4 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Secure Workflow Guide is an agent skill from trailofbits/skills, published by the product's own GitHub organization. Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including assets (for example `agents/openai.yaml`, `resources/EXAMPLE_REPORT.md` and `resources/WORKFLOW_STEPS.md`).
It sits in Security, covering Smart contracts, Smart contract auditing and Fuzzing. The repository describes itself as: Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows. The licence is CC-BY-SA-4.0.
When your agent uses it
- Securing a smart contract end to end rather than hunting one bug
- Checking a project on every check-in
- Before deployment
- Triaging a Slither report
Example prompts
- “Use the secure-workflow-guide skill to guide through Trail of Bits' 5-step secure development workflow”
- “/secure-workflow-guide”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 82fe822. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
meetings.hubspot.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Secure Workflow Guide loads about 1.7k tokens when it runs. Until then it costs about 132 tokens; SKILL.md has 748 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from trailofbits/skills at commit 82fe822, republished under its CC-BY-SA-4.0 licence (© trailofbits). 748 words, ~1,687 tokens.
Download SKILL.mdSave it as
.claude/skills/secure-workflow-guide/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- secure-workflow-guide
- description
- Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
Secure Workflow Guide
Purpose
Guides through Trail of Bits' secure development workflow - a 5-step process to enhance smart contract security throughout development.
Use this: On every check-in, before deployment, or when you want a security review
The 5-Step Workflow
Covers a security workflow including:
Step 1: Check for Known Security Issues
Run Slither with 70+ built-in detectors to find common vulnerabilities:
- Parse findings by severity
- Explain each issue with file references
- Recommend fixes
- Help triage false positives
Goal: Clean Slither report or documented triages
Step 2: Check Special Features
Detect and validate applicable features:
- Upgradeability: slither-check-upgradeability (17 upgrade risks)
- ERC conformance: slither-check-erc (6 common specs)
- Token integration: Recommend token-integration-analyzer skill
- Security properties: slither-prop for ERC20
Note: Only runs checks that apply to your codebase
Step 3: Visual Security Inspection
Generate 3 security diagrams:
- Inheritance graph: Identify shadowing and C3 linearization issues
- Function summary: Show visibility and access controls
- Variables and authorization: Map who can write to state variables
Review each diagram for security concerns
Step 4: Document Security Properties
Help document critical security properties:
- State machine transitions and invariants
- Access control requirements
- Arithmetic constraints and precision
- External interaction safety
- Standards conformance
Then set up testing:
- Echidna: Property-based fuzzing with invariants
- Manticore: Formal verification with symbolic execution
- Custom Slither checks: Project-specific business logic
Note: Most important activity for security
Step 5: Manual Review Areas
Analyze areas automated tools miss:
- Privacy: On-chain secrets, commit-reveal needs
- Front-running: Slippage protection, ordering risks, MEV
- Cryptography: Weak randomness, signature issues, hash collisions
- DeFi interactions: Oracle manipulation, flash loans, protocol assumptions
Search codebase for these patterns and flag risks
For detailed instructions, commands, and explanations for each step, see WORKFLOW_STEPS.md.
How I Work
When invoked, I will:
- Explore your codebase to understand structure
- Run Step 1: Slither security scan
- Detect and run Step 2: Special feature checks (only what applies)
- Generate Step 3: Visual security diagrams
- Guide Step 4: Security property documentation
- Analyze Step 5: Manual review areas
- Provide action plan: Prioritized fixes and next steps
Adapts based on:
- What tools you have installed
- What's applicable to your project
- Where you are in development
Show full SKILL.md (394 more words)Show less
Rationalizations (Do Not Skip)
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "Slither not available, I'll check manually" | Manual checking misses 70+ detector patterns | Install and run Slither, or document why it's blocked |
| "Can't generate diagrams, I'll describe the architecture" | Descriptions aren't visual - diagrams reveal patterns text misses | Execute slither --print commands, generate actual visual outputs |
| "No upgrades detected, skip upgradeability checks" | Proxies and upgrades are often implicit or planned | Verify with codebase search before skipping Step 2 checks |
| "Not a token, skip ERC checks" | Tokens can be integrated without obvious ERC inheritance | Check for token interactions, transfers, balances before skipping |
| "Can't set up Echidna now, suggesting it for later" | Property-based testing is Step 4, not optional | Document properties now, set up fuzzing infrastructure |
| "No DeFi interactions, skip oracle/flash loan checks" | DeFi patterns appear in unexpected places (price feeds, external calls) | Complete Step 5 manual review, search codebase for patterns |
| "This step doesn't apply to my project" | "Not applicable" without verification = missed vulnerabilities | Verify with explicit codebase search before declaring N/A |
| "I'll provide generic security advice instead of running workflow" | Generic advice isn't actionable, workflow finds specific issues | Execute all 5 steps, generate project-specific findings with file:line references |
Example Output
When I complete the workflow, you'll get a comprehensive security report covering:
- Step 1: Slither findings with severity, file references, and fix recommendations
- Step 2: Special feature validation results (upgradeability, ERC conformance, etc.)
- Step 3: Visual diagrams analyzing inheritance, functions, and state variable authorization
- Step 4: Documented security properties and testing setup (Echidna/Manticore)
- Step 5: Manual review findings (privacy, front-running, cryptography, DeFi risks)
- Action plan: Critical/high/medium priority tasks with effort estimates
- Workflow checklist: Progress on all 5 steps
For a complete example workflow report, see EXAMPLE_REPORT.md.
What You'll Get
Security Report:
- Slither findings with severity and fixes
- Special feature validation results
- Visual diagrams (PNG/PDF)
- Manual review findings
Action Plan:
- Critical issues to fix immediately
- Security properties to document
- Testing to set up (Echidna/Manticore)
- Manual areas to review
Workflow Checklist:
- Clean Slither report
- Special features validated
- Visual inspection complete
- Properties documented
- Manual review done
Getting Help
Trail of Bits Resources:
- Office Hours: Every Tuesday (schedule)
- Empire Hacking Slack: #crytic and #ethereum channels
Other Security:
- Remember: Security is about more than smart contracts
- Off-chain security (owner keys, infrastructure) equally critical
Ready to Start
Let me know when you're ready and I'll run through the workflow with your codebase!
© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (assets) in plugins/building-secure-contracts/skills/secure-workflow-guide of trailofbits/skills.
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- resources/EXAMPLE_REPORT.md
- resources/WORKFLOW_STEPS.md
Open the folder on GitHubat commit 82fe822
Compare with similar skills
Secure Workflow Guide next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Secure Workflow Guide this skilltrailofbits/skills | 7.4k | — | ~1.7k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Fizzpashov/skills | 1.2k | 2 repos | ~11k | Automated safety check: Pass | MIT | |
| Fizz Convertpashov/skills | 1.2k | 2 repos | ~3.7k | Automated safety check: Pass | MIT | |
| Stateful Invariant Testingaviggiano/security | 144 | — | ~2.8k | Automated safety check: Pass | MIT | |
| Reentrancy Auditoralt-research2/SolidityGuard | 104 | — | ~1.8k | Automated safety check: Pass | Custom licence | |
| Smart Contract Auditforefy/.context | 152 | 1 repos | ~5.1k | Automated safety check: Pass | MIT |
Similar skills
Fizz Convert
pashov/skills
Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.
Stateful Invariant Testing
aviggiano/security
Build metric-driven Chimera/create-chimera-app stateful invariant testing campaigns for Solidity projects.
Reentrancy Auditor
alt-research2/SolidityGuard
Deep reentrancy vulnerability analysis for Solidity contracts.
Smart Contract Audit
forefy/.context
Comprehensive smart contract security audit framework with multi-expert analysis.
Smart Contract Audit
elophanto/EloPhanto
A skill your agent uses when reviewing a Solidity, Vyper, or Rust (Solana/Anchor) smart contract for paid audit work or pre-launch sanity check.
More from trailofbits/skills
All 79 skills in this repo- Official
CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
- Official
Code Graph Mermaid Diagrams
trailofbits/skills
Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.
- Official
Trailmark Graph Evolution
trailofbits/skills
Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.
- Official
Let Fate Decide
trailofbits/skills
Draws a 12 Houses tarot spread to break ties when a request is vague or casually delegated, then reads the cards to pick the next step.
- Official
Semgrep Security Scan
trailofbits/skills
Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.
- Official
Burp Suite Project Parser
trailofbits/skills
Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.
Related
Categories
Questions about Secure Workflow Guide
What does Secure Workflow Guide do?
Guides through Trail of Bits' 5-step secure development workflow. Secure Workflow Guide is an agent skill from trailofbits/skills, published by the product's own GitHub organization. Guides through Trail of Bits' 5-step secure development workflow.
When should I use Secure Workflow Guide?
Secure Workflow Guide fits situations like: securing a smart contract end to end rather than hunting one bug; checking a project on every check-in; before deployment; triaging a Slither report.
How do I install Secure Workflow Guide in Claude Code?
Run `npx skills add trailofbits/skills --skill secure-workflow-guide -a claude-code`. Or copy the skill folder (plugins/building-secure-contracts/skills/secure-workflow-guide in trailofbits/skills) into .claude/skills/secure-workflow-guide in your project. Claude Code loads it when a task matches its description.
How do I install Secure Workflow Guide in Codex?
Run `npx skills add trailofbits/skills --skill secure-workflow-guide -a codex`. Or copy the skill folder (plugins/building-secure-contracts/skills/secure-workflow-guide in trailofbits/skills) into .agents/skills/secure-workflow-guide in your project. Codex loads it when a task matches its description.
Can I use Secure Workflow Guide in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills --skill secure-workflow-guide -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/secure-workflow-guide, .gemini/skills/secure-workflow-guide, .github/skills/secure-workflow-guide and .opencode/skills/secure-workflow-guide in your project.
What does Secure Workflow Guide need to run?
SKILL.md names no scripts, command-line tools or credentials: Secure Workflow Guide is instructions for the agent only.
Does Secure Workflow Guide access the network?
SKILL.md names 1 domain. As links in the text: meetings.hubspot.com. This is read from the text; nothing was executed.
Is Secure Workflow Guide safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Secure Workflow Guide use?
Secure Workflow Guide is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Secure Workflow Guide use?
About 1.7k tokens (SKILL.md is roughly 6.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Secure Workflow Guide?
Skills that share tags, products or a category with Secure Workflow Guide: Fizz (pashov/skills, 1.2k stars), Fizz Convert (pashov/skills, 1.2k stars), Stateful Invariant Testing (aviggiano/security, 144 stars) and Reentrancy Auditor (alt-research2/SolidityGuard, 104 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Secure Workflow Guide?
trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills, which has 7,400 GitHub stars. The repository holds 79 skills in this directory. The repository was last updated on October 2, 2026.
Source: trailofbits/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.