[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJMT1KN9EFAQSZ6YQYP396":3,"skill-same:01M6FJMT1KN9EFAQSZ6YQYP396":55},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":30,"frontMatter":31,"refName":32,"commitSha":33,"skillDirectory":34,"forksCount":35,"repositoryHtmlUrl":36,"repositoryHomepageUrl":37,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M6FJMT1KN9EFAQSZ6YQYP396","secure-workflow-guide",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fsecure-workflow-guide\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[23,24,25,26,27],"workflow","secure","guide","workflow guide","secure workflow guide","2026-11-10 10:12:30",false,"# Secure Workflow Guide\n\n## Purpose\n\nGuides through Trail of Bits' secure development workflow - a 5-step process to enhance smart contract security throughout development.\n\n**Use this**: On every check-in, before deployment, or when you want a security review\n\n---\n\n## The 5-Step Workflow\n\nCovers a security workflow including:\n\n### Step 1: Check for Known Security Issues\nRun Slither with 70+ built-in detectors to find common vulnerabilities:\n- Parse findings by severity\n- Explain each issue with file references\n- Recommend fixes\n- Help triage false positives\n\n**Goal**: Clean Slither report or documented triages\n\n### Step 2: Check Special Features\nDetect and validate applicable features:\n- **Upgradeability**: slither-check-upgradeability (17 upgrade risks)\n- **ERC conformance**: slither-check-erc (6 common specs)\n- **Token integration**: Recommend token-integration-analyzer skill\n- **Security properties**: slither-prop for ERC20\n\n**Note**: Only runs checks that apply to your codebase\n\n### Step 3: Visual Security Inspection\nGenerate 3 security diagrams:\n- **Inheritance graph**: Identify shadowing and C3 linearization issues\n- **Function summary**: Show visibility and access controls\n- **Variables and authorization**: Map who can write to state variables\n\nReview each diagram for security concerns\n\n### Step 4: Document Security Properties\nHelp document critical security properties:\n- State machine transitions and invariants\n- Access control requirements\n- Arithmetic constraints and precision\n- External interaction safety\n- Standards conformance\n\nThen set up testing:\n- **Echidna**: Property-based fuzzing with invariants\n- **Manticore**: Formal verification with symbolic execution\n- **Custom Slither checks**: Project-specific business logic\n\n**Note**: Most important activity for security\n\n### Step 5: Manual Review Areas\nAnalyze areas automated tools miss:\n- **Privacy**: On-chain secrets, commit-reveal needs\n- **Front-running**: Slippage protection, ordering risks, MEV\n- **Cryptography**: Weak randomness, signature issues, hash collisions\n- **DeFi interactions**: Oracle manipulation, flash loans, protocol assumptions\n\nSearch codebase for these patterns and flag risks\n\nFor detailed instructions, commands, and explanations for each step, see [WORKFLOW_STEPS.md](resources\u002FWORKFLOW_STEPS.md).\n\n---\n\n## How I Work\n\nWhen invoked, I will:\n\n1. **Explore your codebase** to understand structure\n2. **Run Step 1**: Slither security scan\n3. **Detect and run Step 2**: Special feature checks (only what applies)\n4. **Generate Step 3**: Visual security diagrams\n5. **Guide Step 4**: Security property documentation\n6. **Analyze Step 5**: Manual review areas\n7. **Provide action plan**: Prioritized fixes and next steps\n\nAdapts based on:\n- What tools you have installed\n- What's applicable to your project\n- Where you are in development\n\n---\n\n## Rationalizations (Do Not Skip)\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"Slither not available, I'll check manually\" | Manual checking misses 70+ detector patterns | Install and run Slither, or document why it's blocked |\n| \"Can't generate diagrams, I'll describe the architecture\" | Descriptions aren't visual - diagrams reveal patterns text misses | Execute slither --print commands, generate actual visual outputs |\n| \"No upgrades detected, skip upgradeability checks\" | Proxies and upgrades are often implicit or planned | Verify with codebase search before skipping Step 2 checks |\n| \"Not a token, skip ERC checks\" | Tokens can be integrated without obvious ERC inheritance | Check for token interactions, transfers, balances before skipping |\n| \"Can't set up Echidna now, suggesting it for later\" | Property-based testing is Step 4, not optional | Document properties now, set up fuzzing infrastructure |\n| \"No DeFi interactions, skip oracle\u002Fflash loan checks\" | DeFi patterns appear in unexpected places (price feeds, external calls) | Complete Step 5 manual review, search codebase for patterns |\n| \"This step doesn't apply to my project\" | \"Not applicable\" without verification = missed vulnerabilities | Verify with explicit codebase search before declaring N\u002FA |\n| \"I'll provide generic security advice instead of running workflow\" | Generic advice isn't actionable, workflow finds specific issues | Execute all 5 steps, generate project-specific findings with file:line references |\n\n---\n\n## Example Output\n\nWhen I complete the workflow, you'll get a comprehensive security report covering:\n\n- **Step 1**: Slither findings with severity, file references, and fix recommendations\n- **Step 2**: Special feature validation results (upgradeability, ERC conformance, etc.)\n- **Step 3**: Visual diagrams analyzing inheritance, functions, and state variable authorization\n- **Step 4**: Documented security properties and testing setup (Echidna\u002FManticore)\n- **Step 5**: Manual review findings (privacy, front-running, cryptography, DeFi risks)\n- **Action plan**: Critical\u002Fhigh\u002Fmedium priority tasks with effort estimates\n- **Workflow checklist**: Progress on all 5 steps\n\nFor a complete example workflow report, see [EXAMPLE_REPORT.md](resources\u002FEXAMPLE_REPORT.md).\n\n---\n\n## What You'll Get\n\n**Security Report**:\n- Slither findings with severity and fixes\n- Special feature validation results\n- Visual diagrams (PNG\u002FPDF)\n- Manual review findings\n\n**Action Plan**:\n- [ ] Critical issues to fix immediately\n- [ ] Security properties to document\n- [ ] Testing to set up (Echidna\u002FManticore)\n- [ ] Manual areas to review\n\n**Workflow Checklist**:\n- [ ] Clean Slither report\n- [ ] Special features validated\n- [ ] Visual inspection complete\n- [ ] Properties documented\n- [ ] Manual review done\n\n---\n\n## Getting Help\n\n**Trail of Bits Resources**:\n- Office Hours: Every Tuesday ([schedule](https:\u002F\u002Fmeetings.hubspot.com\u002Ftrailofbits\u002Foffice-hours))\n- Empire Hacking Slack: #crytic and #ethereum channels\n\n**Other Security**:\n- Remember: Security is about more than smart contracts\n- Off-chain security (owner keys, infrastructure) equally critical\n\n---\n\n## Ready to Start\n\nLet me know when you're ready and I'll run through the workflow with your codebase!\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Ftrailofbits\u002Fskills\u002Fsecure-workflow-guide",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill secure-workflow-guide",{"tool":47,"command":48},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill secure-workflow-guide",{"tool":50,"command":51},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill secure-workflow-guide","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fsecure-workflow-guide\u002FSKILL.md",true,[],[56,66,76,85,91,98],{"skillNo":57,"name":58,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":62,"publishedAt":28},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[61],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[63,64,65],"model","model hierarchy","model hierarchy skill",{"skillNo":67,"name":68,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":72,"publishedAt":28},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[71],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[73,74,75],"MCP","zoom","zoom mcp",{"skillNo":77,"name":78,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":28},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[82,83,84,74],"sdk","zoom apps sdk","apps",{"skillNo":86,"name":87,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":28},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[87],{"skillNo":92,"name":93,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":97,"publishedAt":28},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[96],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[93],{"skillNo":99,"name":100,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":28},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[100]]