secure-workflow-guide

Guide Solidity developers through Trail of Bits' 5-step secure development workflow.

2|Updated Jan 21, 2026

Search Tags:#workflow #security #verification #diagrams #smart-contracts #Slither

Ready to run

npx skills add https://github.com/roderik/mpe --skill secure-workflow-guide

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-workflow-guide
Source: https://github.com/roderik/mpe/tree/main/.agents/skills/secure-workflow-guide
Command: npx skills add https://github.com/roderik/mpe --skill secure-workflow-guide

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill guides developers through Trail of Bits' 5-step secure development workflow for smart contracts, ensuring security checks are performed at each stage of development.

Core Features & Use Cases

Runs Slither scans to identify vulnerabilities and triage findings.
Checks upgradeability, ERC conformance, and token integration to ensure standards compliance.
Generates visual security diagrams and documents security properties for fuzzing and formal verification.
Provides a structured manual review checklist to catch issues automated tools miss.

Quick Start

Trigger the Secure Workflow Guide on your Solidity codebase to start the 5-step process. Examples: run the skill in CLI or call it through your agent. Then follow Step 1: run Slither, Step 2: check features, Step 3: generate diagrams, Step 4: document properties, Step 5: perform manual review.

Frequently Asked Questions about secure-workflow-guide

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a full smart contract security workflow before deployment?▼

A full smart contract security workflow involves running Slither scans, checking upgradeability and ERC conformance, generating security diagrams, documenting properties for fuzzing, and performing a manual review. This structured approach identifies vulnerabilities and ensures standards compliance.

What does Slither scan for in a Solidity codebase?▼

Slither scans Solidity codebases to identify static analysis vulnerabilities and triage findings. It detects issues like unused variables, uninitialized storage, and reentrancy paths, serving as the foundational automated security check before deeper manual review.

How do I document smart contract security properties for formal verification?▼

Documenting smart contract security properties for formal verification involves defining invariants and expected behaviors of the contract. Generating visual security diagrams and detailed property documentation provides the necessary specifications for fuzzing and formal verification tools.

Can I use this secure development workflow for non-upgradeable smart contracts?▼

The secure development workflow applies to various Solidity projects, but it specifically includes checks for upgradeability patterns. For non-upgradeable contracts, you can still use the workflow for Slither scans, ERC conformance checks, and manual security review, skipping upgrade-specific validations.

What is the best way to visualize security structures in smart contracts?▼

The best way to visualize security structures in smart contracts is by generating dedicated security diagrams. These diagrams map out contract interactions, access controls, and data flows, helping developers understand the architecture and identify potential attack vectors.

Why do I need a manual security review if I already ran Slither?▼

A manual security review is necessary because automated tools like Slither cannot catch all logic flaws, business logic vulnerabilities, or complex systemic risks. A structured manual review checklist catches issues automated tools miss, ensuring comprehensive contract security.