PlugWiki

solidity-security Skill for Claude Code: Safer Smart Contracts

solidity-security makes Claude write and review Solidity smart contracts with common attacks in mind, such as reentrancy and weak access control.

Installs
15.6K
on skills.sh
Stars
42.1K
on GitHub
Files
1
besides SKILL.md
Updated
Oct 2026
last repo commit

solidity-security is a reference skill from wshobson's agents collection. Claude uses it when you write, audit or prepare contracts. The patterns cover reentrancy, integer overflow and underflow, access control and front-running, plus safe patterns and gas savings.

The SKILL.md has Hardhat test examples for reentrancy, overflow and access control, and an audit-preparation section on documentation. The vulnerability patterns and the 15-item checklist sit in references/details.md.

It is guidance, not an auditor. The skill does not run a scanner, so have contracts that hold real funds audited by professionals.

Good for

  • Smart contract developers writing DeFi or token contracts
  • Developers reviewing a contract before sending it to an auditor
  • Learners studying common smart contract vulnerabilities

Install solidity-security

Claude Code

  1. 1

    Copy this prompt.

    Install the solidity-security skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install blockchain-web3@claude-code-workflows

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole blockchain-web3 plugin: 1 agent and 4 skills (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands.

From the project README. Source.

What's in the skill

When it loads

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Sections in SKILL.md

  1. When to Use This Skill
  2. Detailed patterns and worked examples
  3. Testing for Security
  4. Audit Preparation

Key facts

License (per GitHub)
MIT
Author
wshobson (repo owner)
Repository
wshobson/agents, folder plugins/blockchain-web3/skills/solidity-security
Installs on skills.sh
15,608 as of 2026-11-02
Repo stars
42,081 as of 2026-11-02 (whole repo)
Last repo commit
2026-10-30
Files in the skill folder
2 files including SKILL.md
skills.sh audits
Gen Agent Trust Hub: pass; Socket: pass; Snyk: pass

What it includes

  • Reentrancy, overflow, access control, front-running

    Four vulnerability write-ups in references/details.md with secure patterns.

    Critical vulnerabilities

  • Checks-effects-interactions, pull payments, validation, circuit breaker

    Patterns for ordering state changes before external calls, letting users withdraw, validating input and pausing a contract.

    Security best practices

  • Four cheaper-storage and call patterns

    Use uint256, pack storage variables, use calldata instead of memory for function arguments, and use events for data storage.

    Gas optimization

  • Hardhat tests for attacks

    Tests that try a reentrancy attack, integer overflow and an unauthorized withdrawal.

    Runs code · Testing for security

  • Document a contract for auditors

    A documented example contract with NatSpec comments and checks-effects-interactions ordering.

    Audit preparation

  • 15 checks

    Reentrancy protection, overflow, access control, input validation, front-running, gas, emergency stop, pull payments, no delegatecall to untrusted contracts, no tx.origin, events, external calls last, return value checks, no hardcoded addresses and upgrade mechanism.

    Vulnerabilities checklist

From the official docs

Questions

What does the solidity-security skill do?

It gives Claude a set of secure Solidity patterns and vulnerability checks. Claude uses it to write contracts that avoid common attacks, and to review existing ones.

How do I install it?

Use the install box above and pick one route. The skills CLI route installs only this skill. The plugin route installs the whole blockchain-web3 plugin, which adds 1 agent and 4 skills (counted from the repo tree).

Can it replace a professional audit?

No. The skill is a checklist and a set of patterns for Claude to follow, and it bundles no analyzer. It includes an audit preparation example, which is about getting a contract ready for professional audit.

Does it need an API key or tools like Slither?

The SKILL.md names no key and no analyzer. It uses Hardhat in its test example, so you need a Hardhat project to run those tests.

Is it safe?

It bundles no scripts: the folder is SKILL.md plus one reference file. Our advice: treat Claude's contract code as untested until you run the tests, and get a review before any mainnet deployment.

Which vulnerabilities does it cover?

Reentrancy, integer overflow and underflow, access control and front-running get full write-ups. The checklist adds delegatecall, tx.origin, return values and hardcoded addresses.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/blockchain-web3/skills/solidity-security

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4
  1. solidity-security SKILL.md · github.com
  2. wshobson/agents README · github.com
  3. plugin.json · github.com
  4. references/details.md · github.com

Updated Nov 2, 2026.