---
title: "Secure Workflow Guide - Air Market"
description: "You have contract code and you know it needs a security pass, but not where to start or what order to do things in. This walks you through a five-step workflow: automated scanning, checks on the tric…"
canonical: "https://airmarket.ai/app/secure-workflow-guide"
---

[Air Market](/) / [Security](/category/security) / Secure Workflow Guide

Skill by [Trail of Bits](/@trailofbits)

# Secure Workflow Guide

A step-by-step path through securing your smart contract work

## What this does

You have contract code and you know it needs a security pass, but not where to start or what order to do things in. This walks you through a five-step workflow: automated scanning, checks on the tricky parts like upgrades and token handling, diagrams of what you're looking at, and the manual review areas a tool won't catch.

### Top 3 things it does for you

- Walk me through a secure development review
- Run a Slither scan on my contracts
- Check upgradeability, ERC conformance and token integration

## Information

**Secure Workflow Guide at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Trail of Bits](/@trailofbits) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 20 KB |
| Licence | CC-BY-SA-4.0 |
| Repository | [trailofbits/skills](https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/secure-workflow-guide) |
| GitHub stars | 6,823 (as of Nov 2026) |
| Installs | 7,811, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Secure Workflow Guide and flagged nothing. AIR's verdict: **safe**.

**What Secure Workflow Guide's check was run against**

|  |  |
| --- | --- |
| Commit | d5fe2e6a7896236c3102fd5477e833623ad70298 |
| Content hash | fb812b040d3d0268f1bb7d8dc639a99ae3a38cee582b1d60af125aafa52e61c7 |
| Files read | [Browse the files at this exact commit](https://github.com/trailofbits/skills/blob/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/secure-workflow-guide/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Secure Workflow Guide](/security/secure-workflow-guide)

## About Secure Workflow Guide

This follows Trail of Bits' five-step secure development workflow from start to finish, so a review has a shape instead of being a pile of separate checks.

Along the way it runs Slither scans, looks at the special features that tend to cause trouble - upgradeability, ERC conformance, token integration - and generates visual diagrams of what it finds.

It also helps you document security properties for fuzzing and verification, and covers the manual review areas that need a person's judgement.

## What's inside

- SKILL.md - instructions
- agents/openai.yaml - data
- assets/trail-of-bits-mark.svg - template
- resources/EXAMPLE_REPORT.md - reference
- resources/WORKFLOW_STEPS.md - reference

## Questions

### Is Secure Workflow Guide safe to install?

AIR scanned this exact version of Secure Workflow Guide and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit d5fe2e6a7896, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/secure-workflow-guide.

### How do I install Secure Workflow Guide?

Open https://airmarket.ai/app/secure-workflow-guide on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/secure-workflow-guide. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Trail of Bits](/@trailofbits)

---

Canonical URL: <https://airmarket.ai/app/secure-workflow-guide>