How do I install the Hedera Smart Contract Audit skill?

Run npx skillmds@latest add evaluris-solutions/hedera-smart-contract-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hedera Smart Contract Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hedera Smart Contract Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hedera Smart Contract Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Hedera Smart Contract Audit?

Evaluris-Solutions (@evaluris-solutions) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hedera Smart Contract Audit by evaluris-solutions

Name: Hedera Smart Contract Audit
Rating: 4.666666666666667 (3 reviews)
Author: Evaluris-Solutions

Hedera Smart Contract Audit

Security audit playbook for Hedera EVM contracts — Slither and Mythril wiring, HIP-1195 hook/allowance abuse checks, HTS precompile reentrancy review, manual checklist distinct from vanilla Ethereum, structured findings report with CVSS scoring guidance for DLT quirks. Use when user mentions audit Hedera contract, Slither Hedera, Mythril, HIP-1195, HTS reentrancy, bug bounty prep Hedera.

File contents

Overview

Auditing Hedera contracts combines standard Ethereum tooling with network-specific invariants (HTS precompile behavior, decimal quirks, hook-enabled ERC-20 flows).

When to use this skill

Preparing bug bounty submissions (Bug bounty scope).
Running static analysis in CI for Solidity repos targeting Hedera relays.

Prerequisites

Python 3.10+ for Slither/Mythril.
Compiled artifacts (artifacts/ + source maps).

Workflow

Static analysis — run ./scripts/run-audit.sh after customizing compiler version inside repo.
Manual review — walk checklist in references/audit-checklist.md.
Hedera-specific classes — investigate hook-enabled allowances per HIP-1195 & HTS interactions (references/hedera-vuln-taxonomy.md).
Reporting — populate scripts/audit-template.md.
Scoring — apply CVSS but annotate network-layer exploitability assumptions.

Examples

Example 1

“Slither on Hedera fork.”

Point Slither at flattened contracts + relay RPC if differential testing needed.

Example 2

“Does reentrancy matter on HTS?”

Yes — treat HTS calls as external interactions possibly invoking hooks.

Example 3

“Need bounty-ready write-up.”

Include reproducible testnet PoC + impacted contracts list.

Troubleshooting

Issue	Tip
Mythril timeouts	Narrow bytecode scope

References

Local: references/hedera-vuln-taxonomy.md, references/audit-checklist.md, references/2023-hts-exploit.md, references/bug-bounty-scope.md

---name: hedera-smart-contract-auditdescription: Security audit playbook for Hedera EVM contracts — Slither and Mythril wiring, HIP-1195 hook/allowance abuse checks, HTS precompile reentrancy review, manual checklist distinct from vanilla Ethereum, structured findings report with CVSS scoring guidance for DLT quirks. Use when user mentions audit Hedera contract, Slither Hedera, Mythril, HIP-1195, HTS reentrancy, bug bounty prep Hedera.---## OverviewAuditing Hedera contracts combines **standard Ethereum tooling** with **network-specific invariants** (HTS precompile behavior, decimal quirks, hook-enabled ERC-20 flows).## When to use this skill- Preparing **bug bounty** submissions ([Bug bounty scope](https://hedera.com/bug-bounty)).- Running static analysis in CI for Solidity repos targeting Hedera relays.## Prerequisites- Python 3.10+ for Slither/Mythril.- Compiled artifacts (`artifacts/` + source maps).## Workflow1. **Static analysis** — run `./scripts/run-audit.sh` after customizing compiler version inside repo.2. **Manual review** — walk checklist in [references/audit-checklist.md](references/audit-checklist.md).3. **Hedera-specific classes** — investigate hook-enabled allowances per HIP-1195 & HTS interactions ([references/hedera-vuln-taxonomy.md](references/hedera-vuln-taxonomy.md)).4. **Reporting** — populate [scripts/audit-template.md](scripts/audit-template.md).5. **Scoring** — apply CVSS but annotate **network-layer exploitability** assumptions.## Examples**Example 1**> “Slither on Hedera fork.”Point Slither at flattened contracts + relay RPC if differential testing needed.**Example 2**> “Does reentrancy matter on HTS?”Yes — treat HTS calls as external interactions possibly invoking hooks.**Example 3**> “Need bounty-ready write-up.”Include reproducible testnet PoC + impacted contracts list.## Troubleshooting| Issue | Tip || --- | --- || Mythril timeouts | Narrow bytecode scope |## References- Local: [references/hedera-vuln-taxonomy.md](references/hedera-vuln-taxonomy.md), [references/audit-checklist.md](references/audit-checklist.md), [references/2023-hts-exploit.md](references/2023-hts-exploit.md), [references/bug-bounty-scope.md](references/bug-bounty-scope.md)

Frequently asked questions