Contractscan Action — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Contractscan Action (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scan Solidity smart contracts for security vulnerabilities in your CI/CD pipeline.
ContractScan uses Slither static analysis with AI-enhanced reporting to detect vulnerabilities in your smart contracts on every push and pull request.
# Free tier (no API key needed):
- name: Scan smart contracts
uses: h33min/contractscan-action@v1
# With API key (unlimited scans):
- name: Scan smart contracts
uses: h33min/contractscan-action@v1
with:
api-key: ${{ secrets.CONTRACTSCAN_API_KEY }}| Input | Required | Default | Description |
|---|---|---|---|
api-key | No | — | ContractScan API key. Optional for free tier. Store as a repository secret for paid plans. |
api-url | No | https://contract-scanner.raccoonworld.xyz | ContractScan API base URL |
path | No | **/*.sol | Glob pattern for Solidity files to scan |
fail-on | No | Critical | Minimum severity that fails CI (Critical, High, Medium, Low) |
report-format | No | markdown | Output format: markdown or json |
max-files | No | 300 | Maximum number of files to scan per run |
node_modules/, lib/, dependencies/) into a single archive for correct import resolution| Output | Description |
|---|---|
findings-count | Total number of findings |
critical-count | Number of Critical severity findings |
passed | true if all scans passed the threshold |
See example-workflow.yml for a complete example including PR comments.
Free tier works without an API key. For unlimited scans, visit ContractScan to generate an API key.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.