flare-builders-toolkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flare-builders-toolkit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill is the entry point to a 16-skill bundle for Flare-family EVM development. When invoked, route to the right sub-skill(s) based on what the task needs.
Security is the default. Every contract under discussion is assumed hostile-attacked. Patterns that aren't safe-by-default (Ownable instead of Ownable2Step, raw transfer instead of SafeERC20, unbounded loops, push-style ETH transfers, missing reentrancy guards) are flagged as findings, not described as alternatives. Read flare-security first for any contract design or review work.
When the user asks a Flare-development question, route them to the most specific sub-skill that fits. Multiple sub-skills can apply to one question. Don't try to answer from this skill alone — it's the router, not the source of truth.
| User asks about… | Use sub-skill(s) |
|---|---|
| Chain ID, RPC URL, block explorer URL, faucet, faster RPC | flare-network |
| Token address (WFLR, WSGB, USDT0, USDC.e, sFLR, FXRP, HLN, APS, …) | flare-network |
| Permit2 / Multicall3 deployed address per chain | flare-network |
| Enosys V3 / SparkDEX V3.1 / SparkDEX V4 / BlazeSwap / OpenOcean address | flare-network |
Contract verification on flare-explorer or flarescan | flare-network |
| What is FTSO / FDC / FAssets / Smart Accounts | flare-general, then the specific protocol skill |
| Reading FTSO price feeds, anchor feeds, volatility | flare-ftso |
| Cross-chain proofs, BTC/XRPL state into Flare | flare-fdc |
| FXRP minting, redemption, agents, gasless payments | flare-fassets |
| ERC-4337 smart accounts on Flare | flare-smart-accounts |
| Enosys DEX V3 NFT positions, reward managers, FlareDrops, rFLR, APS incentives | enosys-dex-v3 |
| Enosys Loans/CDP, governance staking, contract addresses | enosys-contracts |
| Why X is silently failing on Flare (RPC log range, MetaMask SDK hang, claim OOG, basefee, EIP-3855, WFLR transfer hook) | flare-dapp-pitfalls |
| Solidity coding standards (general) | solidity |
| Security review of a Flare contract before deploy | flare-security |
| Run a checklist-style audit against a contract | audit |
| Run an adversarial multi-agent audit against a contract | audit-contract |
| Optimize gas | gas-optimize |
| Generate a Foundry test suite | test-foundry |
| Generate a Hardhat test suite | test-hardhat |
| "I'm building a new Flare contract" | Sequence below ↓ |
When the task is "build and ship a Flare contract", walk these in order. Read the linked skills as you go — don't try to remember everything.
flare-general plus anyprotocol-specific skills the contract will touch (flare-ftso, flare-fdc, flare-fassets, flare-smart-accounts, enosys-contracts, enosys-dex-v3).
flare-network. Don't guess; don't trust training-data addresses; look them up.
solidity Cyfrin standards asthe baseline.
flare-securitycovers what solidity doesn't: Permit2 chain availability, FoT detection, blacklist surface, basefee floors, FTSO redistributor proxy quirks. Add flare-dapp-pitfalls for the gotcha catalog.
test-foundry for unit + fork + fuzzcoverage. (Hardhat alternative in test-hardhat; Foundry is preferred.)
gas-optimize for rankedsavings.
audit (systematic, 115+ items) +audit-contract (adversarial, multi-agent). After both run, reread [`flare-security`](flare-security/SKILL.md) Part 2 — Flare-specific overlays aren't in the generic audit checklists.
flare-network work for both Blockscout (flare-explorer) and Routescan/Etherscan-style (flarescan).
Before broadcasting to Flare mainnet, every item below must be green. Full detail in flare-security.
forge build clean; all contracts under 24 KB runtimeforge test (unit) + forge test --fork-url flare (fork) all passOwnable2Step + Ledger/multisig handoffOwnable2Step (not Ownable); reentrancy guards on every state-changingexternal function; CEI in every flow
SafeERC20 + forceApprove for every token interactiontx.origin for auth; no unbounded loops over user-controlled data__audit + audit-contract both run; findings fixed or acceptedflare-explorer and flarescanSKILL.md (frontmatter +body) plus optional references/, scripts/, or *.md supporting docs.
flare-ftso, flare-fassets) include referencescripts in TypeScript and Solidity. They're illustrative; the user is responsible for security review before signing or broadcasting.
flare-network) is the single source of truth forany deployed-contract or token address. If a sub-skill mentions a different address than flare-network, raise it as a discrepancy and verify.
use chain-specific tooling.
validator docs.
Wallet signing happens in user-controlled environments.
If the user is asking you to review a specific contract, start with [`flare-security`](flare-security/SKILL.md) to set the security baseline, then run audit and audit-contract against the file. After those complete, reread flare-security Part 2 to verify the Flare-specific overlays — Permit2 availability, FoT detection, blacklist surface, basefee floor, FTSO redistributor handling — were caught. The generic audit skills are not chain-aware.
For more detailed orientation, the README.md in this same directory is a human-readable map of the toolkit.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.