Skip to content
Back to skills

Solidity Conventions

ASecurity

Apply Solidity project conventions — Foundry only (forge, cast, anvil, chisel; no Hardhat or Truffle), forge fmt with sort_imports, solhint:all strict (--max-warnings=0 --noPoster) extending compiler-version ^0.8.22, fuzz tests via Foundry's built-in fuzzing, invariant tests via forge-std/StdInvariant.sol with handlers, gas snapshots via forge snapshot, coverage via forge coverage --report lcov, and script/Scratch.s.sol or chisel for scratch (never inline forge script heredocs). Use when star...

  • 4 stars
  • 0 votes
  • 0 copies
  • 5 views
  • Added September 12, 2026
testingbashexpresstestinggitci/cd

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 12, 2026

npx -y skills add aibot88/sec_skill_store --skill solidity-conventions --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Solidity Conventions?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Solidity Conventions
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/aibot88-solidity-conventions/badge)](https://www.skillsdirectory.com/skills/aibot88-solidity-conventions)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: solidity-conventions
description: Apply Solidity project conventions — Foundry only (forge, cast, anvil, chisel; no Hardhat or Truffle), forge fmt with sort_imports, solhint:all strict (--max-warnings=0 --noPoster) extending compiler-version ^0.8.22, fuzz tests via Foundry's built-in fuzzing, invariant tests via forge-std/StdInvariant.sol with handlers, gas snapshots via forge snapshot, coverage via forge coverage --report lcov, and script/Scratch.s.sol or chisel for scratch (never inline forge script heredocs). Use when starting a Solidity project, writing or reviewing Solidity contracts and tests, configuring Foundry or solhint, or evaluating compliance with these defaults. Co-activates with running-tdd-cycles, reviewing-changes, and engineering-philosophy.
allowed-tools: Read, Edit, Write, Grep, Glob, Bash(forge *), Bash(cast *), Bash(anvil *), Bash(chisel *), Bash(solhint *), Bash(yarn lint:*), Bash(npm run lint:*)
globs: "**/*.sol"
paths: "**/*.sol"
---

## Default Stack

If the repo doesn't define its own tooling, use:

- **Foundry** — build, test, scripts (`forge`, `cast`, `anvil`, `chisel`)
- **forge fmt** — formatting (`sort_imports = true`, `contract_new_lines = true`, `bracket_spacing = true`)
- **solhint** `^6.0.0` — linting, run with `--max-warnings=0 --noPoster`
- **GitHub Actions** — CI/CD, separate `build_and_test` and `linter` jobs
- **Husky** — `pre-commit` hook runs `npm run lint:check`

## Testing

- **Forge tests only** — `forge test -vvv`. No Hardhat/Truffle unless the repo already uses them.
- **Test files** — `test/**/*.t.sol`, one contract under test per file, named `<ContractOrFeature>.t.sol`.
- **Fuzz tests** — use Foundry's built-in fuzzing: parameterize test inputs (`function testFoo(uint256 x) public`) and let `forge` generate random inputs. Add `vm.assume(...)` for invariants, bound inputs with `bound(x, min, max)` rather than `if`-guards.
- **Invariant tests** — for stateful properties, use `forge-std/StdInvariant.sol` with handler contracts.
- **Gas snapshots** — `forge snapshot` for regression tracking when gas matters.
- **Coverage** — `forge coverage --report lcov` in CI.

## Linter Rules (solhint)

**Default is the strictest available.** Extend `solhint:all` (every rule enabled) and run with `--max-warnings=0` so warnings block CI.

Logic (`.solhint.json`):

```json
{
    "extends": "solhint:all",
    "rules": {
        "compiler-version": ["error", "^0.8.22"]
    }
}
```

Tests (`test/.solhint.json`) — minimum opt-outs for practical Foundry patterns:

```json
{
    "extends": "solhint:all",
    "rules": {
        "compiler-version": ["error", "^0.8.22"],
        "one-contract-per-file": "off",
        "no-console": "off",
        "func-name-mixedcase": "off",
        "reason-string": "off"
    }
}
```

Relax individual rules in-project only when you hit a real conflict — never pre-emptively.

## Scripts

Add to `package.json`:

```json
"lint:check": "yarn lint:version && yarn lint:sol-logic && yarn lint:sol-tests && forge fmt --check",
"lint:fix": "forge fmt && yarn lint:sol-tests --fix && yarn lint:sol-logic --fix",
"lint:sol-logic": "solhint -c .solhint.json 'src/**/*.sol' --max-warnings=0 --noPoster",
"lint:sol-tests": "solhint -c test/.solhint.json 'test/**/*.sol' --max-warnings=0 --noPoster",
"lint:version": "solhint --version"
```

(Swap `src/` ↔ `contracts/` to match the repo's `foundry.toml` `src =`.)

## Scratch Testing

**NEVER use inline Solidity via `forge script --via-stdin` or heredocs.**

For ad-hoc exploration:
- **Chisel** (`chisel`) — REPL for one-off expressions and cheatcode checks.
- **`script/Scratch.s.sol`** — throwaway forge script in repo root's `script/`, run with `forge script script/Scratch.s.sol`. Comment out previous blocks to keep history. Gitignored — never commit; move to a real script if the code should persist.

## Reference

- [solhint.json.example](reference/solhint.json.example) — copy-paste starter.
- [foundry.toml.example](reference/foundry.toml.example) — copy-paste starter.

Files in this skill

  • SKILL.md4 KB
  • source.json1.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.