develop-secure-contracts by openzeppelin/openzeppelin-skills
npx skills add https://github.com/openzeppelin/openzeppelin-skills --skill develop-secure-contracts对于概念性问题("Ownable 如何工作?"),进行解释而无需生成代码。对于实现请求,请遵循以下工作流程。
在生成代码或建议更改之前:
Glob 搜索 **/*.sol、**/*.cairo、**/*.rs 等)如果无法读取文件,请明确报告失败 — 报告尝试的路径和原因。询问路径是否正确。切勿在文件不存在时静默回退到通用响应。
在编写任何逻辑之前,先在 OpenZeppelin 库中搜索现有组件:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
切勿将库源代码复制或嵌入到用户的合约中。始终从依赖项导入,以便项目接收安全更新。切勿手写库已提供的功能:
Pausable 或 ERC20Pausable 存在时,切勿编写自定义的 paused 修饰符Ownable 存在时,切勿编写 require(msg.sender == owner)主要工作流程是从库源代码中发现模式:
有关完整的逐步过程,请参阅下面的模式发现与集成。
如果在运行时 MCP 生成器工具可用,请使用它们来加速模式发现:生成基线、启用功能后生成、比较差异,然后将更改应用到用户的代码。这取代了手动阅读源代码的步骤,但遵循相同的原则 — 发现模式,然后集成它们。
有关检查可用性和使用生成-比较-应用快捷方式的详细信息,请参阅 MCP 生成器(可选)。
如果没有所需的 MCP 工具,请使用模式发现与集成中的通用模式发现方法。缺少 MCP 工具并不意味着库缺乏支持 — 仅意味着没有生成器。
通过阅读依赖源代码来发现和应用 OpenZeppelin 合约集成模式的程序指南。适用于任何生态系统和任何库版本。
先决条件: 始终遵循上述库优先决策树(优先使用库组件而非自定义代码,切勿复制/嵌入源代码)。
Glob 搜索 **/*.sol、**/*.cairo、**/*.rs 或下面查找表中的相关扩展名。node_modules/@openzeppelin/contracts/ (Hardhat/npm) 或 lib/openzeppelin-contracts/ (Foundry/forge)Scarb.toml 依赖项解析 — 源代码由 Scarb 缓存Cargo.toml 解析 — 源代码在 target/ 或 cargo 注册表缓存 (~/.cargo/registry/src/)Cargo.toml 解析 — 与 Stylus 相同的 cargo 缓存位置Glob 模式(例如,node_modules/@openzeppelin/contracts/**/*.sol)。不要假设了解库的内容 — 始终通过列出目录来验证。///、/** */)、Rust 和 Cairo 中的文档注释(///),以及组件目录中的 README 文件。test/、tests/、examples/ 或 mocks/ 目录。根据步骤 2,构建所需的最小更改集:
如果合约是可升级的,上述任何一项都可能影响存储兼容性。在应用之前请咨询相关的升级技能。
不要包含超出依赖项要求的任何内容。这是"没有该功能的合约"与"具有该功能的合约"之间的最小差异。
Edit 工具应用步骤 3 中的更改。不要替换整个文件 — 集成到现有代码中。| 生态系统 | 仓库 | 文档 | 文件扩展名 | 依赖项位置 |
|---|---|---|---|---|
| Solidity | openzeppelin-contracts | docs.openzeppelin.com/contracts | .sol | node_modules/@openzeppelin/contracts/ 或 lib/openzeppelin-contracts/ |
| Cairo | cairo-contracts | docs.openzeppelin.com/contracts-cairo | .cairo | Scarb 缓存(从 Scarb.toml 解析) |
| Stylus | rust-contracts-stylus | docs.openzeppelin.com/contracts-stylus | .rs | Cargo 缓存 (~/.cargo/registry/src/) |
| Stellar | stellar-contracts (架构) | docs.openzeppelin.com/stellar-contracts | .rs | Cargo 缓存 (~/.cargo/registry/src/) |
在每个仓库中查找组件的位置:
| 类别 | Solidity | Cairo | Stylus | Stellar |
|---|---|---|---|---|
| 代币 | contracts/token/{ERC20,ERC721,ERC1155}/ | packages/token/ | contracts/src/token/ | packages/tokens/ |
| 访问控制 | contracts/access/ | packages/access/ | contracts/src/access/ | packages/access/ |
| 治理 | contracts/governance/ | packages/governance/ | — | packages/governance/ |
| 代理/升级 | contracts/proxy/ | packages/upgrades/ | contracts/src/proxy/ | packages/contract-utils/ |
| 实用工具/安全 | contracts/utils/ | packages/utils/, packages/security/ | contracts/src/utils/ | packages/contract-utils/ |
| 账户 | contracts/account/ | packages/account/ | — | packages/accounts/ |
在搜索组件时,首先浏览这些路径。
不要根据先验知识假设覆盖点 — 始终通过阅读已安装的源代码来验证。在旧版本中是 virtual 的函数在当前版本中可能不再是,使其不可覆盖。源代码 NatSpec 将指示正确的覆盖点(例如,注意:此函数不是虚拟的,应改为覆盖 {X})。
一个已知的例子:Solidity ERC-20 的 transfer 钩子在 v4 和 v5 之间发生了变化。在推荐覆盖之前,请阅读已安装的 ERC20.sol 以确认哪个函数是 virtual。
MCP 生成器是生成 OpenZeppelin 合约样板代码的模板/脚手架工具。它们不是必需的 — 它们在可用时加速模式发现。
在运行时动态发现 MCP 工具。查找名称匹配模式如 solidity-erc20、cairo-erc721、stellar-fungible 等的工具。服务器名称遵循如 OpenZeppelinSolidityContracts、OpenZeppelinCairoContracts 或 OpenZeppelinContracts 等模式。
MCP 工具模式是自描述的。要了解生成器支持什么,请检查其参数列表 — 每个布尔参数(例如,pausable、mintable、upgradeable)对应一个功能开关。不要依赖对存在哪些参数的先验知识;每次都要阅读模式,因为工具是独立于此技能更新的。
当存在对应合约类型的 MCP 生成器时:
对于交互功能(例如,访问控制 + 可升级性),也生成一个组合变体。
缺少 MCP 工具并不意味着库缺乏支持。这只意味着没有针对该合约类型的生成器。始终回退到模式发现与集成中的通用模式发现方法。
同样,当 MCP 工具存在但未为特定功能公开参数时,不要就此停止。回退到该功能的模式发现:阅读已安装的库源代码以找到相关组件,提取集成要求,并将其应用到用户的合约。
每周安装次数
136
仓库
GitHub 星标数
158
首次出现
2026年3月5日
安全审计
安装于
opencode135
codex103
cursor102
gemini-cli102
kimi-cli102
amp102
For conceptual questions ("How does Ownable work?"), explain without generating code. For implementation requests, proceed with the workflow below.
Before generating code or suggesting changes:
Glob for **/*.sol, **/*.cairo, **/*.rs, etc.)If a file cannot be read, surface the failure explicitly — report the path attempted and the reason. Ask whether the path is correct. Never silently fall back to a generic response as if the file does not exist.
Before writing ANY logic, search the OpenZeppelin library for an existing component:
NEVER copy or embed library source code into the user's contract. Always import from the dependency so the project receives security updates. Never hand-write what the library already provides:
paused modifier when Pausable or ERC20Pausable existsrequire(msg.sender == owner) when Ownable existsThe primary workflow is pattern discovery from library source code :
See Pattern Discovery and Integration below for the full step-by-step procedure.
If MCP generator tools are available at runtime, use them to accelerate pattern discovery: generate a baseline, generate with a feature enabled, compare the diff, and apply the changes to the user's code. This replaces the manual source-reading step but follows the same principle — discover patterns, then integrate them.
See MCP Generators (Optional) for details on checking availability and using the generate-compare-apply shortcut.
If no MCP tool exists for what's needed, use the generic pattern discovery methodology from Pattern Discovery and Integration. The absence of an MCP tool does not mean the library lacks support — it only means there is no generator.
Procedural guide for discovering and applying OpenZeppelin contract integration patterns by reading dependency source code. Works for any ecosystem and any library version.
Prerequisite: Always follow the library-first decision tree above (prefer library components over custom code, never copy/embed source).
Glob for **/*.sol, **/*.cairo, **/*.rs, or the relevant extension from the lookup table below.node_modules/@openzeppelin/contracts/ (Hardhat/npm) or lib/openzeppelin-contracts/ (Foundry/forge)Scarb.toml dependencies — source cached by ScarbCargo.toml — source in target/ or the cargo registry cache ()///, /** */) in Solidity, doc comments (///) in Rust and Cairo, and README files in the component's directory.test/, tests/, , or directories.From Step 2, construct the minimal set of changes needed:
If the contract is upgradeable, any of the above may affect storage compatibility. Consult the relevant upgrade skill before applying.
Do not include anything beyond what the dependency requires. This is the minimal diff between "contract without the feature" and "contract with the feature."
Edit tool. Do not replace the entire file — integrate into existing code.| Ecosystem | Repository | Documentation | File Extension | Dependency Location |
|---|---|---|---|---|
| Solidity | openzeppelin-contracts | docs.openzeppelin.com/contracts | .sol | node_modules/@openzeppelin/contracts/ or lib/openzeppelin-contracts/ |
| Cairo | cairo-contracts | docs.openzeppelin.com/contracts-cairo | .cairo |
Where to find components within each repository:
| Category | Solidity | Cairo | Stylus | Stellar |
|---|---|---|---|---|
| Tokens | contracts/token/{ERC20,ERC721,ERC1155}/ | packages/token/ | contracts/src/token/ | packages/tokens/ |
| Access control | contracts/access/ | packages/access/ |
Browse these paths first when searching for a component.
Do not assume override points from prior knowledge — always verify by reading the installed source. Functions that were virtual in an older version may no longer be in the current one, making them non-overridable. The source NatSpec will indicate the correct override point (e.g., NOTE: This function is not virtual, {X} should be overridden instead).
A known example: the Solidity ERC-20 transfer hook changed between v4 and v5. Read the installed ERC20.sol to confirm which function is virtual before recommending an override.
MCP generators are template/scaffolding tools that produce OpenZeppelin contract boilerplate. They are not required — they accelerate pattern discovery when available.
Discover MCP tools dynamically at runtime. Look for tools with names matching patterns like solidity-erc20, cairo-erc721, stellar-fungible, etc. Server names follow patterns like OpenZeppelinSolidityContracts, OpenZeppelinCairoContracts, or OpenZeppelinContracts.
MCP tool schemas are self-describing. To learn what a generator supports, inspect its parameter list — each boolean parameter (e.g., pausable, mintable, upgradeable) corresponds to a feature toggle. Do not rely on prior knowledge of what parameters exist; read the schema each time, since tools are updated independently of this skill.
When an MCP generator exists for the contract type:
For interacting features (e.g., access control + upgradeability), generate a combined variant as well.
The absence of an MCP tool does NOT mean the library lacks support. It only means there is no generator for that contract type. Always fall back to the generic pattern discovery methodology in Pattern Discovery and Integration.
Similarly, when an MCP tool exists but does not expose a parameter for a specific feature, do not stop there. Fall back to pattern discovery for that feature: read the installed library source to find the relevant component, extract the integration requirements, and apply them to the user's contract.
Weekly Installs
136
Repository
GitHub Stars
158
First Seen
Mar 5, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
opencode135
codex103
cursor102
gemini-cli102
kimi-cli102
amp102
Azure RBAC 权限管理工具:查找最小角色、创建自定义角色与自动化分配
127,200 周安装
~/.cargo/registry/src/Cargo.toml — same cargo cache locations as StylusGlob patterns against the installed source (e.g., node_modules/@openzeppelin/contracts/**/*.sol). Do not assume knowledge of the library's contents — always verify by listing directories.examples/mocks/Scarb cache (resolve from Scarb.toml) |
| Stylus | rust-contracts-stylus | docs.openzeppelin.com/contracts-stylus | .rs | Cargo cache (~/.cargo/registry/src/) |
| Stellar | stellar-contracts (Architecture) | docs.openzeppelin.com/stellar-contracts | .rs | Cargo cache (~/.cargo/registry/src/) |
contracts/src/access/packages/access/ |
| Governance | contracts/governance/ | packages/governance/ | — | packages/governance/ |
| Proxies / Upgrades | contracts/proxy/ | packages/upgrades/ | contracts/src/proxy/ | packages/contract-utils/ |
| Utilities / Security | contracts/utils/ | packages/utils/, packages/security/ | contracts/src/utils/ | packages/contract-utils/ |
| Accounts | contracts/account/ | packages/account/ | — | packages/accounts/ |