From cardano-dev-skills
Performs structured security reviews of Cardano smart contracts written in Aiken, Plutus, or OpShin, identifying vulnerabilities with severity ratings and remediation.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cardano-dev-skills:review-contractThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
<!-- Documentation lookup path: ${CLAUDE_SKILL_DIR}/../../docs/sources/ -->
Perform a structured security review of a Cardano smart contract (validator, minting policy, or staking script). Produces findings with severity ratings and actionable remediation.
Read the validator source files and any associated documentation.
Search the project for related files:
Search the bundled documentation for relevant content:
${CLAUDE_SKILL_DIR}/../../docs/sources/aiken/ - Aiken language docs${CLAUDE_SKILL_DIR}/../../docs/sources/aiken-design-patterns/ - Aiken design patterns${CLAUDE_SKILL_DIR}/../../docs/sources/smart-contract-vulnerabilities/ - Smart contract vulnerability reference${CLAUDE_SKILL_DIR}/../../docs/sources/plutus/ - Plutus docsGo through every item in the vulnerability checklist (see References below). For each pattern:
Key checks by contract type:
Spending validators:
Minting policies:
Staking validators:
Aiken:
expect vs when/is -- expect causes script failure on mismatch; sometimes this is desired, sometimes it hides logic errorsbuiltin functions vs stdlibPlutus (Haskell):
error vs returning FalsePlutusTx.IsData derivationsOpShin (Python):
Organize findings by severity:
For each finding, provide:
### [Severity] Finding title
**Location**: file:line
**Pattern**: Which vulnerability pattern from the checklist
**Description**: What the issue is
**Impact**: What an attacker could do
**Recommendation**: How to fix it
End with a summary table and overall risk assessment.
references/vulnerability-checklist.md -- The 26 eUTxO vulnerability patterns with detection and mitigation guidance${CLAUDE_SKILL_DIR}/../../docs/sources/ for protocol specifications, design documents, and architecture notesnpx claudepluginhub cardano-foundation/cardano-dev-skills --plugin cardano-dev-skillsProvides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.