How to use the Ethereum smart contract vulnerability skill

What does the skill make the agent do?

Smart contracts are programs that run on the Ethereum blockchain. Once deployed they are immutable and often hold real money, so problems need to be found before release. This skill guides the agent through a static and symbolic analysis of Solidity code using two established tools.

Slither performs fast static analysis and checks code against known vulnerability patterns using its 90+ built-in detectors. Mythril uses symbolic execution to explore possible execution paths and find issues such as reentrancy and integer overflows that depend on path-specific behaviour. The agent runs both, helps triage the findings by severity, removes duplicates and likely false positives, and writes a structured report with SWC identifiers, affected functions and suggested fixes.

• Runs Slither against your contract codebase
• Runs Mythril deep analysis on contracts
• Combines, deduplicates and triages findings by exploitability and financial impact
• Produces a JSON report with SWC identifiers, severity ratings, affected functions and suggested fixes

Install the skill from a ZIP file

Download the ZIP file of the skill from this page. Unzip it so that the skill folder, which contains SKILL.md, scripts/agent.py and references/api-reference.md, sits in a skills directory that your agent reads.

For a personal install, place it in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder so it only applies there.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Install the tools the skill needs

The skill calls Slither and Mythril, so both must be installed on the machine where the agent runs. You need Python 3.10 or newer with pip. Slither also needs the solc compiler, and Mythril works with solc-select to manage compiler versions. Foundry or Hardhat is optional and only helps with project-level analysis.

The source gives these install commands for the tools:

• Python 3.10+ and pip
• Slither (slither-analyzer) and the solc compiler
• Mythril (myth) and solc-select
• Solidity source code or compiled contract bytecode
• Optional: Foundry or Hardhat

How do you trigger the skill with a natural request?

You do not need a special command. Describe the audit in plain language and mention the contracts and the goal. The agent should match the request to the skill's description, which covers static and symbolic analysis of Solidity for reentrancy, integer overflow, access control and other vulnerability classes before deployment.

Be specific about the code location and what you want back. A request that names a folder and asks for a report gives the agent enough to follow the workflow of running Slither, running Mythril, triaging, and writing the report.

• Audit the Solidity contracts in contracts/ with Slither and Mythril and give me a severity-ranked report with SWC IDs.
• Check Token.sol for reentrancy and integer overflow before I deploy to mainnet.
• Do a first-pass security review of our DeFi lending contracts and list the fixes I should make.

Run the analysis yourself with the reference commands

The skill's reference file lists the commands the agent uses. You can run them directly to see the raw output before asking the agent to interpret it. Slither can write JSON, run a single detector, or print a summary. Mythril can analyze a single file and write JSON output.

The reference also shows that Slither's detectors are grouped by impact and confidence. Use the list command to see every detector available in your installed version.

• Slither: basic analysis of a folder, JSON output, a specific detector, or a human summary
• Mythril: analyze one file, JSON output, set an execution timeout, or raise the analysis depth

Safety notes: scripts and network access

The skill includes a script, scripts/agent.py, so it runs code on your machine. Read the script before you install the skill in a shared or sensitive environment. The skill's metadata lists that it runs scripts and does not use the network.

One reference command needs care. The Mythril examples include an option that analyzes deployed bytecode by address through an RPC provider. That reads from a live chain and needs network access, which goes against the metadata's network setting. Only use that option if you understand the connection it makes.

Only analyze contracts you own or have written permission to test. The skill is a general workflow and does not check authorisation.

• Review scripts/agent.py before running it
• Deployed-bytecode analysis by address uses an RPC connection
• Analyze only contracts you own or are authorised to test

Tips for better results

Give the agent the whole project rather than one file when you can, so it sees the imports and inheritance. Ask for a JSON report if you plan to feed results into other tools, and check the severity filter so you only review the findings that matter.

Treat the output as a first pass. Static and symbolic tools miss logic flaws and business-logic bugs, so a clean report does not mean the contract is safe. Keep a human review in the loop and re-run the analysis after every change.

• Point the agent at the full project folder
• Ask for JSON output if you want machine-readable results
• Re-run after each code change
• Do not treat a clean report as proof of safety