Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0xlayerghost/solidity-agent-kit --skill solidity-codinggit clone --depth 1 https://github.com/0xlayerghost/solidity-agent-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0xlayerghost/solidity-agent-kit/solidity-coding)<a href="https://agentmods.dev/skills/0xlayerghost/solidity-agent-kit/solidity-coding"><img src="https://agentmods.dev/badge/skills/0xlayerghost/solidity-agent-kit/solidity-coding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0xlayerghost/solidity-agent-kit/solidity-coding"><img src="https://agentmods.dev/badge/skills/0xlayerghost/solidity-agent-kit/solidity-coding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.04149 |
| Opus 5.5 | $0.00026 | $0.01660 |
| Sonnet 5.5 | $0.00013 | $0.00830 |
| Haiku 4.5 | $0.00007 | $0.00415 |
Grade A, and why
solidity-coding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 327 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Solidity Coding Standards
Language Rule
- Always respond in the same language the user is using. If the user asks in Chinese, respond in Chinese. If in English, respond in English.
Coding Principles
- Pragma: Use
pragma solidity ^0.8.19;— keep consistent across all files in the project - Dependencies: OpenZeppelin Contracts 4.9.x, manage imports via
remappings.txt - Error Handling: Prefer custom errors over
requirestrings — saves gas and is more expressive- Define:
error InsufficientBalance(uint256 available, uint256 required); - Use:
if (balance < amount) revert InsufficientBalance(balance, amount);
- Define:
- Documentation: All
public/externalfunctions must have NatSpec (@notice,@param,@return) - Event Indexing: Only add
indexedtoaddresstype parameters — add comment if indexing other types - Special Keywords:
immutable/constant/unchecked/assemblymust have inline comment explaining why
Initialization Strategy
When a contract involves state initialization (external addresses, business parameters, role assignments), DO NOT default to any single approach. Follow this workflow:
Workflow
- Evaluate: Is the contract upgradeable? Are all dependencies known at deploy time? Are there cross-contract deployment order constraints?
- Present options: Show the developer the three initialization schemes below with their trade-offs
- Let the developer choose: Do not assume a scheme — different projects and contracts have different needs
- Implement: Apply the chosen scheme with the safety rules listed below
Scheme Comparison
| Scheme A: Constructor Only | Scheme B: Initializer Only | Scheme C: Hybrid | |
|---|---|---|---|
| Approach | All init in constructor params | Deploy empty, call initialize() after |
Constructor handles known params; initialize() handles post-deploy dependencies |
| Atomicity | Deploy fails = nothing exists, no dangerous half-init state | Risk of "deployed but not initialized" window | Partially atomic — constructor part is safe, initializer part has the window |
| Front-run risk | None — constructor cannot be front-run | initialize() can be front-run if unprotected |
Only the initializer portion has risk |
| Gas | One tx for deploy + init | Deploy tx + N init txs | Deploy tx + 1 init tx |
| Flexibility | Low — all params must be known at deploy time | High — can set dependencies after other contracts deploy | Medium — split between deploy-time and post-deploy |
| Upgradeable | Not compatible with proxy patterns | Required for UUPS / Transparent Proxy | Partial — constructor sets proxy-safe params, initializer for the rest |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · +21 lines 122bd6f0b92c
- 1mo ago Changed · +6 lines 587a702baa31
- 1mo ago First seen · 300 lines · 66 tokens per session scan A 8f397436567f
solidity-coding is a skill published in the GitHub repository 0xlayerghost/solidity-agent-kit (4 stars, last pushed 27d ago), licensed MIT. It adds 66 tokens to every session and 4,149 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
propfund
Trade on PropFund, the decentralized on-chain prop firm for AI agents. Two layers: PropFund SCREENS you (a free evaluation, then a virtual "funded" probation leg that builds an immutable on-chain record — pool-as-counterparty, no real firm capital), and AgentDesk PAYS you (once your record clears the bar you graduate…
programmable-v4-hook-builder
Build, repair, validate, submit, or track a complete Programmable Uniswap v4 Custom launch through the public V3 API. Use when the user names Programmable and wants implementation or launch work for a hook, token, multi-contract graph, app, game, service, or hybrid. Do not use for explanation-only questions, unrelated…
web3-bug-classes
Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.
web3-methodology-research
External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuzzing setup, Slither custom detector writing, attack pattern deep dives, or the 4-phase learning roadmap.
web3-poc-foundry
Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundry cheatcodes, or reproducing a known DeFi hack for learning.
web3-triage-report
Bug triage validation system, Immunefi report format, and 20 real paid bounty examples dissected. Use this when validating a finding before submitting, writing an Immunefi report, checking if a bug is actually valid, or studying real examples of paid vulnerabilities.