Slither

Skill based on Slither (slither-analyzer v0.11.5), generated from sources/slither. Doc path: sources/slither/docs/src/ and repo README.

Slither is a Solidity and Vyper static analysis framework. It runs vulnerability detectors, prints contract structure (call graph, CFG, inheritance, SlithIR), and exposes a Python API and SlithIR for custom analyses. Use it to find bugs, understand code, and integrate into CI or scripts.

Core References

Features

Detectors and printers

Tools

Best Practices

Generation Info

• Source: sources/slither
• Git SHA: 45983a85920687d3131a8d09a37c6deb7fe6e3be
• Generated: 2026-02-24
• Doc path used: sources/slither/docs/src/ (Usage.md, api/, detectors/, printers/, tools/), sources/slither/README.md, sources/slither/CLAUDE.md

Suppression and Output for CI

Control what Slither reports and how, so agents and CI can consume results without noise.

Suppressing findings

• Single line: // slither-disable-next-line DETECTOR_NAME (e.g. reentrancy-eth).
• Block: // slither-disable-start [detector] … // slither-disable-end [detector].
• Custom hint: @custom:security non-reentrant before a variable tells Slither that external calls from that variable are non-reentrant (reduces false positives).
• Triage: run with --triage-mode; choices are stored in slither.db.json. Remove that file to reset.

Prefer inline suppression only where the finding is reviewed and accepted; use triage for one-off runs.

JSON and SARIF

Machine-readable output for CI and tooling:

slither . --json output.json
slither . --sarif output.sarif

JSON top-level: success, error, results. results.detectors is an array of findings; each has check, impact, confidence, description, elements (with type, name, source_mapping). Use for parsing and dashboards.

Checklist and Markdown

Human-oriented reports:

slither . --checklist
slither . --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/

--markdown-root makes links point at the repo for source highlighting.

Config file

Use slither.config.json (or --config-file) to set defaults: detectors_to_run, detectors_to_exclude, printers_to_run, filter_paths, exclude_informational, exclude_low, etc. CLI flags override config. Helps standardize runs across dev and CI.

<!-- Source references:

• sources/slither/docs/src/Usage.md
• sources/slither/docs/src/api/JSON-output.md
• sources/slither/README.md

-->

Slither CLI Usage

How to run Slither and control what it analyzes and reports. Use this when scripting security checks or integrating into CI.

Targets

Slither uses crytic-compile for compilation. Common targets:

# Foundry/Hardhat project (preferred when project has dependencies)
slither .

# Single Solidity file (no imports or use solc)
slither file.sol

# Verified contract on Etherscan (install solc-select for auto solc version)
slither 0x7F37f78cBD74481E593F9C737776F7113d76B315

Detector selection

All detectors run by default. Narrow or exclude for faster runs or to focus on specific issues.

# Run only specific detectors
slither . --detect arbitrary-send-erc20,pragma,reentrancy-eth

# Exclude detectors by name
slither . --exclude naming-convention,unused-state,suicidal

# Exclude by severity
slither . --exclude-informational
slither . --exclude-low

List detectors: slither --list-detectors.

Printer selection

No printers run by default. Use --print for code visualization or export.

slither . --print inheritance-graph
slither . --print call-graph,cfg,function-summary

List printers: slither --list-printers.

Path filtering

Exclude findings that only touch certain paths (dependencies, vendored code). Path can be a directory or filename; supports Python regex.

# Ignore OpenZeppelin (or similar) in results
slither . --filter-paths "openzeppelin"

# Multiple files
slither . --filter-paths "SafeMath.sol|ConvertLib.sol"

Suppressing findings

• Inline: // slither-disable-next-line DETECTOR_NAME before the line.
• Block: // slither-disable-start [detector] … // slither-disable-end [detector].
• Non-reentrant hint: @custom:security non-reentrant before a variable declaration tells Slither that external calls from that variable are non-reentrant.

Triage mode

Interactive triage: Slither asks for each finding whether to hide it in future runs. State is saved in slither.db.json.

slither . --triage-mode

Delete slither.db.json to show hidden results again.

Configuration file

Options can be set in slither.config.json (or --config-file path). CLI overrides config.

Supported options include: detectors_to_run, printers_to_run, detectors_to_exclude / detectors_to_include, exclude_dependencies, exclude_informational / exclude_low / exclude_medium / exclude_high, filter_paths, include_paths, json, sarif, fail_on, etc.

<!-- Source references:

• https://github.com/crytic/slither (README, docs)
• sources/slither/docs/src/Usage.md

-->

Slither Built-in Tools

Separate executables for specific tasks. Use when you need flattening, ERC conformance, mutation testing, upgradeability checks, or storage inspection.

Common tools

When to use

• CI / verification: slither-flat for single-file verification; slither-check-erc for standard compliance.
• Upgradeable contracts: slither-check-upgradeability for proxy/storage layout issues.
• Testing quality: slither-mutate to see if tests/detectors catch simple mutations.
• Debugging: slither-doctor if runs fail; slither-read-storage for on-chain state.
• Documentation: slither-doc, slither-interface for generated docs/interfaces.

All tools accept the same kind of target as slither (directory, file, or Etherscan address when applicable).

<!-- Source references:

• sources/slither/docs/src/tools/README.md

-->