Slither Static Analysis Skill

Expert-level integration with Slither, the leading static analysis framework for Solidity smart contracts.

Capabilities

• Full Detector Suite: Execute Slither with all built-in detectors
• Custom Configurations: Configure analysis parameters and exclusions
• Severity Classification: Interpret and classify finding severity
• False Positive Filtering: Context-aware false positive identification
• Visual Analysis: Generate call graphs and inheritance diagrams
• Custom Detectors: Run and develop custom Slither detectors
• Reporting: Produce comprehensive security reports

Installation

bash
# Install via pip
pip install slither-analyzer

# Or via pipx for isolation
pipx install slither-analyzer

# Verify installation
slither --version

Basic Usage

Run Analysis

bash
# Analyze single file
slither Contract.sol

# Analyze Foundry project
slither . --foundry-compile-all

# Analyze Hardhat project
slither . --hardhat-compile-all

Output Formats

bash
# Human readable (default)
slither .

# JSON output for processing
slither . --json output.json

# Markdown report
slither . --checklist

# SARIF for CI integration
slither . --sarif output.sarif

Detector Categories

High Severity Detectors

| Detector | Description | |----------|-------------| | reentrancy-eth | Reentrancy with ETH transfer | | reentrancy-no-eth | Reentrancy without ETH | | arbitrary-send-eth | Arbitrary ETH send | | controlled-delegatecall | Controlled delegatecall | | suicidal | Functions allowing anyone to destruct | | uninitialized-storage | Uninitialized storage variables |

Medium Severity Detectors

| Detector | Description | |----------|-------------| | reentrancy-benign | Benign reentrancy | | incorrect-equality | Dangerous strict equality | | locked-ether | Contracts that lock ether | | missing-zero-check | Missing zero address validation | | unchecked-transfer | Unchecked token transfers |

Low Severity Detectors

| Detector | Description | |----------|-------------| | naming-convention | Naming convention violations | | external-function | Functions that could be external | | constable-states | State variables that could be constant | | immutable-states | State variables that could be immutable |

Configuration

slither.config.json

json
{
  "detectors_to_run": "all",
  "exclude_informational": false,
  "exclude_low": false,
  "exclude_medium": false,
  "exclude_high": false,
  "exclude_optimization": false,
  "fail_on": "high,medium",
  "filter_paths": [
    "node_modules",
    "lib",
    "test"
  ],
  "exclude_dependencies": true,
  "legacy_ast": false
}

CLI Configuration

bash
# Run specific detectors
slither . --detect reentrancy-eth,uninitialized-storage

# Exclude detectors
slither . --exclude naming-convention,external-function

# Filter by severity
slither . --exclude-informational --exclude-low

# Exclude specific paths
slither . --filter-paths "test|lib|node_modules"

Advanced Features

Call Graph Generation

bash
# Generate call graph
slither . --print call-graph

# Generate inheritance graph
slither . --print inheritance-graph

# Generate contract summary
slither . --print contract-summary

Function Analysis

bash
# Print function summaries
slither . --print function-summary

# Print variable order (storage layout)
slither . --print variable-order

# Print data dependency
slither . --print data-dependency

Custom Detectors

python
# custom_detector.py
from slither.detectors.abstract_detector import AbstractDetector, DetectorClassification

class MyCustomDetector(AbstractDetector):
    ARGUMENT = "my-detector"
    HELP = "Detect my custom issue"
    IMPACT = DetectorClassification.HIGH
    CONFIDENCE = DetectorClassification.HIGH

    WIKI = "https://example.com/my-detector"
    WIKI_TITLE = "My Custom Detector"
    WIKI_DESCRIPTION = "Detects..."
    WIKI_EXPLOIT_SCENARIO = "..."
    WIKI_RECOMMENDATION = "..."

    def _detect(self):
        results = []
        for contract in self.compilation_unit.contracts_derived:
            for function in contract.functions:
                # Detection logic
                if self._has_issue(function):
                    info = [function, " has an issue\n"]
                    results.append(self.generate_result(info))
        return results

CI/CD Integration

GitHub Actions

yaml
name: Slither Analysis
on: [push, pull_request]

jobs:
  slither:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1

      - name: Install Slither
        run: pip install slither-analyzer

      - name: Run Slither
        run: slither . --foundry-compile-all --fail-on high --sarif results.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif

Interpreting Results

Result Structure

json
{
  "success": true,
  "error": null,
  "results": {
    "detectors": [
      {
        "check": "reentrancy-eth",
        "impact": "High",
        "confidence": "Medium",
        "description": "Reentrancy in Contract.withdraw()...",
        "elements": [...],
        "first_markdown_element": "...",
        "id": "abc123"
      }
    ]
  }
}

Triage Workflow

1. High/Medium Impact - Investigate immediately
2. Check Confidence Level - High confidence = likely real issue
3. Review Code Context - Understand the actual flow
4. Verify with Tests - Write tests to confirm behavior
5. Document Decisions - Mark false positives with rationale

Process Integration

| Process | Purpose | |---------|---------| | smart-contract-security-audit.js | Primary security analysis | | smart-contract-development-lifecycle.js | Development validation | | formal-verification.js | Pre-verification checks |

Tools Reference

| Tool | Purpose | |------|---------| | Slither | Core static analyzer | | crytic-compile | Compilation framework | | slither-doctor | Configuration debugger |

Best Practices

• Run Slither on every commit in CI
• Configure appropriate exclusions to reduce noise
• Review all high/medium findings manually
• Write custom detectors for project-specific patterns
• Use --triage-database to track false positives

See Also

• skills/mythril-symbolic/SKILL.md - Symbolic execution analysis
• skills/echidna-fuzzer/SKILL.md - Property-based fuzzing
• agents/solidity-auditor/AGENT.md - Security auditor agent
• Slither Documentation