Code Maturity Assessor
Skill ActiveSystematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing. Produces professional scorecard with evidence-based ratings and actionable recommendations.
To provide a systematic and evidence-based assessment of software codebase maturity, identifying strengths and weaknesses across critical security and development categories to guide improvement efforts.
Features
- Systematic code maturity assessment
- Utilizes Trail of Bits' 9-category framework
- Analyzes arithmetic safety, auditing, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing
- Produces a professional scorecard with ratings and recommendations
- Provides detailed analysis with evidence and an improvement roadmap
Use Cases
- Assessing the security and quality of smart contracts before deployment
- Evaluating existing codebases for areas of technical debt and security risks
- Gaining a comprehensive understanding of a project's development practices and maturity
- Prioritizing code improvement efforts with actionable recommendations
Non-Goals
- Performing real-time vulnerability scanning or exploitation
- Acting as a replacement for comprehensive security audits by human experts
- Providing automated code fixes directly, only recommendations
- Assessing project management or business aspects outside of code quality
Workflow
- Explore codebase to understand project structure, contracts, tests, and documentation.
- Analyze each of the 9 categories by searching code, reading key files, and presenting findings.
- Ask clarifying questions about processes not visible in the code.
- Determine ratings based on defined criteria and interactive discussion.
- Generate a report including an executive summary, scorecard, detailed analysis, and improvement roadmap.
Practices
- Code Quality Assessment
- Security Auditing
- Developer Workflow Improvement
Trust
- warning:Issues AttentionIn the last 90 days, 13 issues were opened and 4 were closed, indicating a low closure rate of approximately 31% and potentially slow maintainer response.
Practical Utility
- info:Usage examplesWhile the SKILL.md describes the process and output format, concrete, copy-pasteable end-to-end examples with claimed outputs are missing.
Installation
First, add the marketplace
/plugin marketplace add trailofbits/skills/plugin install building-secure-contracts@trailofbitsQuality Score
Trust Signals
Similar Extensions
Soul Guardian
100Drift detection + baseline integrity guard for agent workspace files with automatic alerting support
Audit Dependency Versions
100Audit project dependencies for version staleness, security vulnerabilities, and compatibility issues. Covers lock file analysis, upgrade path planning, and breaking change assessment. Use before a release to ensure dependencies are current and secure, during periodic maintenance reviews, after receiving a security advisory, when upgrading to a new language version, before submitting to CRAN or npm, or when inheriting a project to assess its dependency health.
Janitor Tokens
100Show how many context window tokens each skill consumes. Use when the user asks about token cost, context budget, skill size, or wants to know which skills waste the most context space.
Codex Diff Develop
100Revisa el diff de la rama actual frente a develop en proyectos Drupal 11 siguiendo la metodología Codex (lógica de negocio, edge cases de hooks/queries, seguridad, performance, completitud). Genera un informe .md en la carpeta del IDE detectado (.antigravity/, .cursor/, .vscode/ o docs/) con hallazgos por severidad y soluciones accionables. Usar cuando el usuario pida "Revisión diff develop", "revisión diff develop", "diff develop", "revisar diff", "codex diff" o expresiones similares con intención de auditar cambios contra develop. Triggers: diff develop, codex diff, revisión diff, lint diff develop, auditar diff.
Investigate Capa Root Cause
100Investigate root causes and manage CAPAs (Corrective and Preventive Actions) for compliance deviations. Covers investigation method selection (5-Why, fishbone, fault tree), structured root cause analysis, corrective vs preventive action design, effectiveness verification, and trend analysis. Use when an audit finding requires a CAPA, when a deviation or incident occurs in a validated system, when a regulatory observation needs a formal response, when a data integrity anomaly requires investigation, or when recurring issues suggest a systemic root cause.
Toprank Weekly Review
100Run a weekly SEO review for one registered website, write audit artifacts, and choose the next best safe action.