SkillFoxx

HackenProof Skills plugin

A plugin marketplace for Claude Code: triage of EVM smart contract vulnerability reports, PoC grading and fix verification.

  • 52 ★ on the repository
  • Last commit
Plugin

Extended access

Why this level

  • Some plugins reach the bug-bounty platform API through an MCP server with your access.
  • The plugins read vulnerability reports and local code, and some export program reports to files.
All reasons and checks

hackenproof-public/skillsAuthor:hackenproof-public

Install

Works in

Manual install

/plugin marketplace add hackenproof-public/skills

Then `/plugin install hackenproof-fix-verifier@hackenproof-skills` or another plugin from the set.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • Some plugins reach the bug-bounty platform API through an MCP server with your access.
  • The plugins read vulnerability reports and local code, and some export program reports to files.

This is third-party code. Review the repository files before installing.

What it does

The repository publishes ten plugins from the HackenProof triage team. Three work without an account on any report or code: `hackenproof-fix-verifier` checks whether a patch closes the vulnerability without adding new ones, `hackenproof-report-quality-scorer` rates a report from 0 to 8, and `hackenproof-poc-grader` grades exploit evidence. The rest connect to the HackenProof API through its MCP server and suit program members: full single-report triage, bulk triage, report export to Markdown, JSON or CSV, client handoff summaries and closure comment templates. The `examples/solidity-reentrancy` example shows the fix verifier catching an incomplete patch with cross-function reentrancy.

Who it is for. Smart contract auditors and bug-bounty triage teams who process Ethereum and EVM vulnerability reports.

Good fit when

  • A report came without reproduction and `hackenproof-report-quality-scorer` shows what is missing.
  • A developer sent a patch for a found vulnerability and `hackenproof-fix-verifier` checks it for reentrancy, access control, arithmetic and upgrades.
  • A PoC is attached to a report and `hackenproof-poc-grader` places it into one of five grades, from Verified to Invalid.
  • You need to export all program reports to CSV for review.
  • An organization wants to roll the plugin out to all staff through managed Claude Code settings.

Not a fit when

  • You need a code audit that finds new vulnerabilities: the plugins process finished reports and patches.
  • Contracts are not Solidity or not on an EVM chain: the checks are tuned for them.
  • You have no HackenProof program access but need API features: six plugins require it.

Example request

Check whether the patch in `fix.diff` closes the reentrancy from `report.md` and rate the report on a 0 to 8 scale.

Limitations

Part of the plugins call the HackenProof API through an MCP server and work only with program access. The three standalone plugins use HackenProof severity rubrics but do not depend on platform infrastructure. Checks are tuned for Solidity and EVM. The agent gives triage recommendations, and the decision to rate or close a report stays with a person. Standalone plugins send nothing to the platform. The last commit was in October 2026.

How to disable. Disable the plugin through `/plugin` in Claude Code or remove the entry from `enabledPlugins` and `extraKnownMarketplaces` in `.claude/settings.json`.

FAQ

Do I need a HackenProof account?

Not for three plugins: `hackenproof-fix-verifier`, `hackenproof-report-quality-scorer` and `hackenproof-poc-grader`. The rest call the platform API through an MCP server.

How do I add the marketplace?

In `/plugin` on the Marketplaces tab add `hackenproof-public/skills` and install a plugin. For a project the same goes into `.claude/settings.json` through `extraKnownMarketplaces`.

What grades does PoC evaluation have?

Verified, Plausible, Weak, Invalid and Out of Scope Evidence. The skill fetches attachments through MCP, and without it asks you to paste or describe the evidence.

Do the skills work in other agents?

Each skill is a plain `SKILL.md` with reference files under `plugins/<plugin>/skills/<skill>/`, so Agent Skills agents can load them directly.

What does the fix verifier check?

Whether the reported flaw is closed and no new ones are added. For Solidity it checks reentrancy, access control, arithmetic, storage layout and upgrades.

Discussion

No questions or reviews yet.

Plugins
Official

A Claude Code plugin that helps write bug bounty reports from verified facts only, with nothing invented

PluginMinimal access375
Official

A Claude Code marketplace from Trail of Bits: 29 plugins with hooks and scripts reviewed line by line, from fuzzing and Ghidra to documents

PluginBroad access532

Trail of Bits skills

Trail of Bits Skills Marketplace

Editors’ pick

Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing

PluginExtended access8.2K

A skill set for smart contract auditing: bug classes, grep patterns, Foundry PoCs and an Immunefi report format.

SkillBroad access185

A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch

PluginBroad access121

A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation

PluginExtended access581

README in short

A marketplace of ten plugins for processing vulnerability reports. Three are standalone, the rest need HackenProof access through MCP.

README badge

Report a problem