Expert EVM capability skill for secure contract architecture across Ethereum and Base, including Foundry testing and operational controls.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are comparatively strong, but you should still validate source, privacy posture, and package provenance for your environment.
0
96
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as first-party.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
Package marked verified.
Checksum metadata
SHA-256 hash is present.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 0/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
Package verification/checksum metadata is available.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (6/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is present.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
6/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is available.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
3 prerequisites to line up before setup.
Safety & privacy surface
2 safety and 2 privacy notes across 3 risk areas. Review closely: credentials & tokens.
| Platform | Support | Install path |
|---|---|---|
| claude-code | Native | .claude/skills/<skill-name>/SKILL.md |
| codex | Native | .agents/skills/<skill-name>/SKILL.md |
| windsurf | Native | .windsurf/skills/<skill-name>/SKILL.md |
| gemini | Native | .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md |
| cursor | Adapter | .cursor/rules/<skill-name>.mdc |
| cli | Manual | AGENTS.md or tool-specific context file |
# Trigger
"Use the Ethereum/Base smart contract security capability pack for this protocol."
# Required output
1) Threat model and trust assumptions
2) Contract architecture and invariants
3) Foundry test/fuzz/invariant suite plan
4) Deployment and incident response checklistThis capability pack is pinned to documentation verified on 2026-04-10. When upstream docs change, refresh endpoint contracts, examples, and constraints before using this skill for production changes.
Always prefer direct retrieval from official docs/API references over model memory for limits, endpoint signatures, and behavior guarantees.
This capability pack teaches agents to reason about Solidity security at protocol depth across Ethereum and Base environments. It combines architecture discipline, robust testing, and safer operational rollout.
SKILL.md.SKILL.md content as reusable workflow instructions..gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md where supported..cursor/rules/*.mdc adapter for project rules.Issue: Safe tests pass but adversarial behavior still possible
Fix: Expand fuzz + invariant suites and include cross-contract interaction scenarios.
Issue: Upgrade path introduces hidden risk
Fix: Add storage-layout and permission diff checks to release gating.
Issue: Incident response is untested
Fix: Simulate emergency controls before mainnet launch.
Show that Ethereum Base Smart Contract Security Capability Pack Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/skills/ethereum-base-smart-contract-security-capability-pack)Ethereum Base Smart Contract Security Capability Pack Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Source provenance).
| Field | Expert EVM capability skill for secure contract architecture across Ethereum and Base, including Foundry testing and operational controls. Open dossier | Build and harden Ethereum smart contracts with Foundry, invariant testing, and battle-tested OpenZeppelin security patterns. Open dossier | Ship smart contracts on Base with secure deployment, verification, environment management, and production-readiness checklists. Open dossier | Expert GitHub Actions capability skill for secure workflow architecture, token minimization, supply-chain controls, and CI reliability. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package verified2026-04-10 | Package verified2026-04-10 | Package verified2026-04-10 | Package verified2026-04-10 |
| Source provenanceDiffers | Source-backed | No submission link | No submission link | No submission link |
| Submitter | — | — | — | — |
| Install risk | Review first | Low risk | Low risk | Low risk |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | |
| Category | skills | skills | skills | skills |
| Source | First-party | First-party | First-party | First-party |
| Author | JSONbored | JSONbored | JSONbored | JSONbored |
| Added | 2026-04-10 | 2026-04-10 | 2026-04-10 | 2026-04-10 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓Do not deploy or transact from generated contract code without independent review, tests, and a dry run; smart contract mistakes can be irreversible. Use local forks or testnets before mainnet and keep deployment wallets and RPC credentials least-privileged. | ✓Do not deploy or transact from generated contract code without independent review, tests, and a dry run; smart contract mistakes can be irreversible. Use local forks or testnets before mainnet and keep deployment wallets and RPC credentials least-privileged. | ✓Do not deploy or transact from generated contract code without independent review, tests, and a dry run; smart contract mistakes can be irreversible. Use local forks or testnets before mainnet and keep deployment wallets and RPC credentials least-privileged. | ✓May produce commands or configuration for live infrastructure, CI, releases, or indexing; test changes in staging or dry-run mode first. Use least-privilege API tokens and review workflow, deploy, DNS, cache, and release changes before applying them to production. |
| Privacy notes | ✓Prompts and reports can include contract source, audit findings, addresses, deployment config, and transaction context. Never paste private keys, seed phrases, unreleased exploit details, customer wallet data, or privileged RPC credentials into prompts. | ✓Prompts and reports can include contract source, audit findings, addresses, deployment config, and transaction context. Never paste private keys, seed phrases, unreleased exploit details, customer wallet data, or privileged RPC credentials into prompts. | ✓Prompts and reports can include contract source, audit findings, addresses, deployment config, and transaction context. Never paste private keys, seed phrases, unreleased exploit details, customer wallet data, or privileged RPC credentials into prompts. | ✓Inputs can include repository metadata, workflow logs, deployment settings, domain names, analytics exports, and service configuration. Redact tokens, account IDs, private URLs, customer data, and proprietary deployment details before sharing generated reports or prompts. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Smart contract development skill focused on secure Solidity architecture, testing rigor, and safer deployment practices.
Practical launch workflow for Base contracts from local build to verified deployment and post-launch operations.
Source-backed guides for putting this to work.
Audit MCP client configuration before sharing it with a team.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.