Encoding Solidity Security Patterns as Skills for Coding Agents

Awesome Solidity Smart Contract Skills for Agents: battle-tested, industrialized contract patterns for coding agents. AI coding agents are getting very good at writing smart contracts. Give an agent a Solidity file and a reasonably specific prompt, and it will produce a working implementation surprisingly quickly. That's useful. But smart contracts have a property that makes this problem different from ordinary application development. Contracts control assets, and there's no undo A bug in a web backend gets a hotfix. A bug in a live contract gets a bridge drained and once the transaction is mined, there's no undo button. The code doesn't just implement business logic. It controls assets, and often those are user funds. A few lines decide who can move money, when someone can withdraw, whether a signature can be replayed, how losses are distributed, and whether an attacker can seize control of execution at exactly the wrong moment. So the hard part usually isn't knowing Solidity syntax. It's knowing which patterns to reach for before writing the code. That's why I built Awesome Solidity Skills: battle-tested smart-contract patterns, packaged as skills for coding agents. Why yet another style guide isn't enough Most teams solve this the way they've always solved onboarding; a style guide, a Notion page, a security checklist someone wrote two years ago that nobody reopens until an incident. That works reasonably well for a human engineer, who reads it once and internalizes it. It works much worse for an agent, which starts every session with no memory of your Notion page. Someone has to paste the relevant section into context and repeat it over and over. Nothing in this project is novel cryptography or a new idea and that's sort of the point; It's institutional knowledge that already exists, audited and battle-tested, repackaged into a form an agent can act on without a human having to remember to hand it over. The problem with AI-generated Solidity is that although an agent can know Solidity, It can define a mapping, a modifier, a struct, a custom error, delegate-call, or try/catch. It doesn't mean it understands the security assumptions around them. Consider a simple withdrawal: function withdraw(uint256 amount) external { require(balances[msg.sender] >= amount); (bool success,) = msg.sender.call{value: amount}(""); require(success); balances[msg.sender] -= amount; } The code looks reasonable. The problem is the ordering: the contract makes an external call before updating its accounting. That call can hand control to code the recipient controls, and if that code calls withdraw() again, the contract still sees the old balance. This is the basic shape of a reentrancy vulnerability. AI shouldn’t just be told to use nonReentrant. It should internalize through skills that External calls are control-flow boundaries. Your contract's state must stay safe even when execution leaves the contract and comes back before the current function finishes. That distinction is what you actually want an agent to carry. You don't just want it to know Solidity, you want the reasoning patterns experienced developers have learned from years of vulnerabilities, audits, and production systems. The goal isn't a bigger vocabulary. It's better defaults. Where the patterns in these skills come from This isn't another repository of random Solidity advice, we already have plenty of those. Every claim in this skills repo is distilled from a real source, read out of OpenZeppelin, Solady, Solmate, Morpho Blue, Sablier, Uniswap, and Aave indexed from the awesome-smart-contracts repo by shafu0x a renowned smart contracts dev plus the security chapters of from the og book on blockchain: Mastering Ethereum. That changes the question from "What does an AI think is a good Solidity pattern?" to "What patterns have experienced protocol engineers actually used, and how do we make them available to coding agents?" It's a more useful question, because we're entering a different phase of software development where whether AI agents will write smart contracts will not be a question, they already do. We are no longer debating whether AI agents will write smart contracts; they are actively doing it in production environments every day. The real conversation we need to have in the Web3 ecosystem is: What should an agent know before we trust it with user funds? Traditional software agents can survive by learning public frameworks and APIs on the fly. Smart contracts demand an understanding of adversarial execution, economic incentives, and strict accounting invariants. By leveraging native agent skills, we can stop treating AI guardrails as a prompting afterthought and start embedding decades of hard-earned blockchain security directly into the machine's default behavior. Although most of these knowledge is scattered across thousands of pages of docs, source, audits, EIPs, and post-mortems, This skills repo provides all these fragmented knowledge in one useable form that gives smart contract developers and their agents a better starting point. How it Plugs Into Your Dev Workflow Because the skills are organized as directories containing a SKILL.md file with explicit YAML frontmatter, Your ai agent can automatically scan your prompt, recognize the task context (e.g., "add a withdraw function" or “write a simple erc20 token”), and pull the corresponding security skill into its context window natively. You can clone the entire skills repo into your active repository with a few simple commands: All skills (clone into your project): Use this if you want all 10 skills available today (this is an actively growing repo so more skills are added periodically). git clone https://github.com/mystic0xx/awesome-solidity-smart-contracts-skills.git mkdir -p .claude/skills cp -r awesome-solidity-smart-contracts-skills/skills/* .claude/skills/ Personal (available in every project): cp -r awesome-solidity-smart-contracts-skills/skills/* ~/.claude/skills/ A single skill: Load any one of the available skills by name cp -r awesome-solidity-smart-contracts-skills/skills/reentrancy-guards ~/.claude/skills/ Loading awesome-solidity-skills into your repoPrompting your agent to use loaded skillsAwesome Skills found an actual bug in a Claude-generated implementationThe skills aren't theoretical. In practice they've already caught a real bug in code an agent generated, the kind of ordering or assumption mistake that reads as plausible but drains funds in production.What You're Getting When installed locally, the skills repo injects institutional memory directly into your agent's execution loop. The repo provides 10 targeted guardrails for: Defensive Programming: The baseline mindset and anti-pattern catalogue for smart-contract security EIP-712 Signature Verification: Ensures proper cryptographic domain binding, expiring nonces to prevent replay attacks. Escrow Accounting: Standardizes strict internal ledger adjustments, debit-before-transfer checks and transitions. Fixed-Point Rounding: Enforces full-precision math checks to guarantee the protocol always rounds in its own favor. Oracle Safety: Guards against price feed manipulation by tracking data staleness, enforcing rigid reporting bounds. Pausable Circuit Breakers: Implementing emergency stops without trapping user exits. Reentrancy Guards: Standardizing Checks-Effects-Interactions (CEI) design, nonReentrant status. Safe ERC20 Transfers: Safety checks around edge cases like no-return values, fee-on-transfer & approval race conditions. Singleton vs. Clones: Guides the architectural choice between full smart contract deployments and EIP-1167 proxy clones. Two-Step Access Control: Enforces absolute least-privilege configurations using patterns like Ownable2Step or role-based governance over direct single-step ownership. Try And Improve It If you use AI agents to build smart contracts, give it a try: awesome-solidity-smart-contracts-skills. If you know a pattern that belongs here, send a PR; the project is open source, forever. I'd rather have 100 developers improve these skills together than one person claim to have written the definitive Solidity playbook. AI can generate the code. Let's make sure it has access to the lessons that came before it.