solidity-guardian

What This Skill Does

The Solidity Guardian is a comprehensive smart contract security analysis tool designed for the OpenClaw AI agent. It acts as an automated security auditor that scans Solidity source code for vulnerabilities ranging from critical reentrancy exploits to standard best-practice deficiencies. By integrating pattern matching derived from industry-standard resources like Trail of Bits, OpenZeppelin, and Consensys, it ensures that your smart contracts remain robust against common attack vectors. The skill supports both Hardhat and Foundry development environments, making it a versatile addition to any Web3 developer's workflow.

Installation

To add this skill to your OpenClaw agent, use the following installation command in your terminal:

clawhub install openclaw/skills/skills/aviclaw/solidity-guardian

Ensure that your project environment is correctly configured to allow the agent access to your contracts directory. Once installed, you can trigger scans directly through the agent interface or via your CLI.

Use Cases

• Pre-deployment Audits: Perform a quick security check before migrating contracts to a testnet or mainnet.
• CI/CD Integration: Automatically analyze codebase changes in pull requests to catch vulnerabilities introduced during active development.
• Educational Benchmarking: Learn about common security pitfalls by reviewing the detailed findings and fix suggestions provided by the agent.
• Legacy Code Review: Scan older smart contract repositories to identify deprecated patterns or insecure coding practices.

Example Prompts

1. "Solidity Guardian, please scan the contracts/Vault.sol file and generate a markdown report of all findings."
2. "Run a security audit on the entire ./contracts directory and highlight any critical vulnerabilities that require immediate attention."
3. "Analyze my project and suggest fixes for any missing access control or reentrancy risks found in the current implementation."

Tips & Limitations

• Pattern Matching: While the tool is highly effective at catching 40+ known vulnerabilities, it relies on static analysis. It is not a replacement for a manual professional audit by an expert security firm.
• Optimization: For very large projects, consider analyzing individual files or sub-directories to manage the agent's memory usage.
• Contextual Awareness: The tool works best when provided with a clean build environment. Ensure your project compiles successfully before initiating an analysis to ensure the parser has access to all necessary import dependencies.