Skip to main content
hc
Submit
skillsFirst-partyReview first Safety · Privacy ·

Ethereum Base Smart Contract Security Capability Pack Skill

Expert EVM capability skill for secure contract architecture across Ethereum and Base, including Foundry testing and operational controls.

by JSONbored·added 2026-04-10·
Claude CodeCodexWindsurfGeminiCursorCLI
HarnessClaude CodeCodexWindsurfGeminiCursorCLI
Level:expertType:capability-packVerified:validated
Review first — review before installing

Open the source and read safety notes before installing.

Prerequisites

  • Solidity codebase and deployment scripts
  • Security requirements and risk tolerance
  • Testnet staging environment

Schema details

Install type
package
Reading time
10 min
Difficulty score
91
Troubleshooting
Yes
Breaking changes
No
Package metadata
Package verified
Yes
SHA-256
3f10c007835d0f339dc11a96b12cc7951032f9d14ce505951d2c0bf0f43d4312
Skill and platform metadata
Skill type
capability-pack
Skill level
expert
Verification
validated
Verified at
2026-04-10
Retrieval sources
https://ethereum.org/developers/docs/https://book.getfoundry.sh/https://docs.openzeppelin.com/contractshttps://docs.base.org/get-started/deploy-smart-contracts
Tested platforms
ClaudeCodexOpenClawCursorWindsurfGemini
PlatformSupportInstall path
claude-codeNative.claude/skills/<skill-name>/SKILL.md
codexNative.agents/skills/<skill-name>/SKILL.md
windsurfNative.windsurf/skills/<skill-name>/SKILL.md
geminiNative.gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md
cursorAdapter.cursor/rules/<skill-name>.mdc
cliManualAGENTS.md or tool-specific context file
Full copyable content
# Trigger
"Use the Ethereum/Base smart contract security capability pack for this protocol."

# Required output
1) Threat model and trust assumptions
2) Contract architecture and invariants
3) Foundry test/fuzz/invariant suite plan
4) Deployment and incident response checklist

About this resource

Knowledge Freshness

This capability pack is pinned to documentation verified on 2026-04-10. When upstream docs change, refresh endpoint contracts, examples, and constraints before using this skill for production changes.

Retrieval Sources

Always prefer direct retrieval from official docs/API references over model memory for limits, endpoint signatures, and behavior guarantees.

Core Workflow

  1. Confirm target version/runtime and pull latest official docs for the task scope.
  2. Build an execution plan with explicit read-only discovery before any mutation.
  3. Validate contracts, permissions, and safety constraints before applying changes.
  4. Execute with deterministic checkpoints and rollback criteria.
  5. Produce a verification report with evidence, caveats, and next actions.

Overview

This capability pack teaches agents to reason about Solidity security at protocol depth across Ethereum and Base environments. It combines architecture discipline, robust testing, and safer operational rollout.

Capability Scope

  • Threat modeling and trust assumptions
  • Permission and upgrade model hardening
  • Arithmetic/oracle/reentrancy/griefing defense strategies
  • Foundry unit/fuzz/invariant methodology
  • Deployment, monitoring, and emergency controls

Compatibility

Native

  • Claude Code / Claude: native skill usage via SKILL.md.
  • Codex/OpenAI workflows: compatible with Agent Skills-style SKILL.md content as reusable workflow instructions.

Manual Adaptation

  • Gemini CLI: native skill usage via .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md where supported.
  • Cursor: use the generated .cursor/rules/*.mdc adapter for project rules.
  • OpenClaw and similar agents: use the same skill content as a reusable prompt/workflow file when native skill import is unavailable.

Production Rules

  • Treat invariant violations as release blockers.
  • Minimize privileged operations and centralization risk.
  • Verify deployment config parity with audited assumptions.
  • Maintain emergency pathways (pause/kill-switch) with governance constraints.

Troubleshooting

Issue: Safe tests pass but adversarial behavior still possible
Fix: Expand fuzz + invariant suites and include cross-contract interaction scenarios.

Issue: Upgrade path introduces hidden risk
Fix: Add storage-layout and permission diff checks to release gating.

Issue: Incident response is untested
Fix: Simulate emergency controls before mainnet launch.

Output Contract

  1. Provide an implementation plan ordered by risk and dependency.
  2. Provide exact production-ready config/commands with no placeholders.
  3. Call out secrets, permissions, and least-privilege requirements.
  4. Include rollback and recovery guidance for each risky step.

Validation Checklist

  • Verify all referenced docs/versions before applying changes.
  • Run regression checks for core user flow and error paths.
  • Confirm observability/logging is enabled for changed components.
  • Confirm security controls (auth, rate limits, input validation) still pass.
  • Record final known limitations and follow-up actions.
Content outline
#ethereum#base#solidity#security#capability-pack

Source citations

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.