Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing. Produces professional scorecard with evidence-based ratings and actionable recommendations.
The code-maturity-assessor skill provides a systematic evaluation of software codebase maturity using Trail of Bits' 9-category code maturity framework. It helps teams identify security, maintainability, testing, and operational weaknesses by performing structured analysis across critical engineering and smart contract development domains. The skill is designed to produce evidence-based assessments rather than subjective opinions, enabling engineering teams to better understand the current maturity level of their codebase and prioritize improvements using a consistent scoring methodology.
The skill operates in three phases: discovery, analysis, and reporting. During discovery, it explores the project structure, identifies modules and contracts, checks documentation, and reviews testing assets. In the analysis phase, it evaluates the codebase across nine categories including arithmetic safety, auditing practices, authentication and access controls, complexity management, decentralization, documentation quality, transaction ordering risks, low-level manipulation, and testing and verification practices. Findings are supported with code references and assessment criteria, and the skill may request clarification for operational processes not visible directly in source code. The final report includes an executive summary, a maturity scorecard, detailed category-by-category evidence, and a prioritized improvement roadmap.
This skill is particularly useful for smart contract teams, security auditors, protocol developers, engineering leads, and organizations preparing for security reviews or production deployment. It can support internal engineering reviews, audit readiness preparation, governance evaluations, and continuous security improvement initiatives. Teams working on blockchain protocols, decentralized applications, or security-sensitive systems can use the assessment to identify gaps in testing, documentation, privilege management, and operational resilience before release.
The skill evaluates a codebase across nine categories including arithmetic safety, auditing practices, access controls, complexity management, decentralization, documentation, transaction ordering risks, low-level manipulation, and testing and verification.
Yes. The assessment is evidence-based and includes findings with file references and analysis of implementation patterns discovered during code review.
Yes. The framework includes categories such as decentralization, MEV-related transaction ordering risks, upgrade controls, and low-level manipulation that are especially relevant to blockchain and smart contract systems.
No, but the assessment evaluates the availability and quality of documentation, testing coverage, and verification practices as part of the maturity scoring process.
The skill generates an executive summary, maturity scorecard, detailed category analysis with supporting evidence, and a prioritized improvement roadmap with recommendations.
Quick Setup:
.claude/skills/Repository
trailofbits/skills