Is the Smart Contract Vulnerability Auditor skill free?

Yes. The skill itself is free from trailofbits/skills-curated. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Smart Contract Vulnerability Auditor SkillProof Score?

9.2/10 — installs cleanly 4/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.

How do I install Smart Contract Vulnerability Auditor?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Smart Contract Vulnerability Auditor with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Smart Contract Vulnerability Auditor

4-phase Solidity vulnerability scan across 36 exploit classes (Solidity only).

by trailofbits · trailofbits/skills-curated

Works with setup

Install — copy the command Download source ↗

Test report

Verdict: Works with setup
Score: 9.2/10
Tested: Jul 14, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 2755cf1

Ran it against a 4-function test vault seeded with 3 bugs: it caught the reentrancy in withdraw() (external call before balance update), the missing access control on setOwner(), and — only because the cheatsheet's grep-sweep phase forces a check of every .call( site — the easy-to-miss unchecked return in sendReward(). All three matched its own reference files' vulnerable-pattern examples almost verbatim. (Listed here under our older name; the skill's own name is "Smart Contract Vulnerability Auditor".)

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 4/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 5/5

What Smart Contract Vulnerability Auditor does

Loads a condensed 36-class vulnerability cheatsheet, sweeps the codebase with grep plus a semantic read-through, then validates each candidate against a dedicated reference file (preconditions, detection heuristics, false positives, remediation) before writing a severity-rated report. Solidity-only by design: explicitly out of scope for Vyper/Rust/Move contracts, off-chain code, and gas-only reviews. No dedicated oracle-manipulation reference despite that being a common expectation for this category — closest coverage is weak-sources-randomness.md, a different class.

How to install Smart Contract Vulnerability Auditor

git clone https://github.com/trailofbits/skills-curated.git
cd skills-curated
mkdir -p ~/.claude/skills
cp -r plugins/scv-scan/skills/scv-scan ~/.claude/skills/smart-contract-review
# NOTE: SKILL.md tells the agent to read {baseDir}/skills/scv-scan/references/CHEATSHEET.md,
# a path that assumes the plugin's nested layout (baseDir = plugin root). After the flat copy
# above, either edit those in-body paths down to references/... or skip the flat copy and
# install the whole plugins/scv-scan/ folder as a Claude Code plugin instead.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Smart Contract Vulnerability Auditor

/smart-contract-review 4-phase Solidity vulnerability scan across 36 exploit classes (Solidity only).

It also activates on plain-language prompts like these:

Review this Solidity contract for reentrancy vulnerabilities
Check this contract's access control before we deploy it
Run a security checklist against this smart contract

Frequently asked questions

Is the Smart Contract Vulnerability Auditor skill free?: Yes. The skill itself is free from trailofbits/skills-curated. SkillProof publishes the install command and an independent test verdict at no cost.
Does Smart Contract Vulnerability Auditor work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Works with setup. Ran it against a 4-function test vault seeded with 3 bugs: it caught the reentrancy in withdraw() (external call before balance update), the missing access control on setOwner(), and — only because the cheatsheet's grep-sweep phase forces a check of every .call( site — the easy-to-miss unchecked return in sendReward(). All three matched its own reference files' vulnerable-pattern examples almost verbatim. (Listed here under our older name; the skill's own name is "Smart Contract Vulnerability Auditor".)
What is the Smart Contract Vulnerability Auditor SkillProof Score?: 9.2/10 — installs cleanly 4/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install Smart Contract Vulnerability Auditor?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Smart Contract Vulnerability Auditor with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.