secure-workflow-guide

Guides Trail of Bits' 5-step smart contract security workflow using Slither, Echidna, and Manticore.

Updated Mar 22, 2026
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill secure-workflow-guide-tech-hy
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: secure-workflow-guide
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/secure-workflow-guide
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill secure-workflow-guide-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Smart contract developers often skip structured security review or rely on ad-hoc checks, missing vulnerabilities that automated detectors, visual inspection, and property-based testing would catch before deployment. ## Core Features & Use Cases - Automated Vulnerability Scanning: Runs Slither with 70+ detectors, parses findings by severity, and recommends fixes with file references. - Special Feature Validation: Checks upgradeability risks, ERC conformance, and token integration patterns only when applicable to the codebase. - Visual Security Inspection: Generates inheritance graphs, function summaries, and state variable authorization diagrams to reveal shadowing and access control issues. - Property Documentation & Testing: Helps define security invariants and sets up Echidna fuzzing or Manticore formal verification. - Use Case: Before deploying a DeFi staking contract, run the full workflow to get a prioritized action plan covering reentrancy fixes, timelock recommendations, and fuzzing invariants. ## Quick Start Ask the assistant to run the secure development workflow on your Solidity project and produce a security report with an action plan.

Frequently Asked Questions about secure-workflow-guide

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Slither security scan on my Solidity project?

Run 'slither . --exclude-dependencies' from your project root to execute 70+ built-in vulnerability detectors. The workflow parses findings by severity, explains each issue with file references, and helps triage false positives.

What tools check smart contract upgradeability and ERC conformance?

Use slither-check-upgradeability to detect 17 upgrade risks in proxy patterns and slither-check-erc to validate conformance to standards like ERC20. The workflow auto-detects which checks apply to your codebase.

How do I set up Echidna fuzzing for smart contract invariants?

Document security properties as Solidity functions prefixed with 'echidna_', then configure echidna.yaml with test mode, run limits, and sender addresses. The workflow helps define invariants like balance sufficiency and state consistency.

Does this workflow work if Slither is not installed?

No, Slither is required for Steps 1-3 since manual checking misses the 70+ detector patterns and visual diagrams. You must install Slither or explicitly document why the scan is blocked before proceeding.

What security risks do automated tools miss in smart contracts?

Automated tools miss privacy leaks, front-running and MEV exposure, weak randomness or signature issues, and DeFi-specific risks like oracle manipulation and flash loan attacks. Step 5 of the workflow manually reviews these areas.