cosmos-vulnerability-scanner
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, blockchain, cosmos, security, smart-contracts.
What it does
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill cosmos-vulnerability-scannerOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner ~/.claude/skills/cosmos-vulnerability-scannerSafety box score
Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is an audit workflow for Cosmos SDK / CosmWasm repos; it reads source, spawns read-only scanning agents, and writes audit artifacts (`CLAUDE.md` plus finding markdown files). The main risks are workspace modification and broad automated analysis, not execution of downloaded code or privileged system changes.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell execution or code evaluation is shipped here; the workflow only specifies Agent/Read/Grep/Glob actions and no native scripts. |
| Network access | 0 (none) | The skill does not instruct downloads or remote exfiltration; the URLs are reference material only. |
| Filesystem reach | 1 (low) | It writes `CLAUDE.md` to the target repo root and finding files under an output directory such as `.bughunt_cosmos/`. |
| Secrets & credentials | 0 (none) | No token stores, keychains, `.env` files, or credential prompts are mentioned. |
| Privilege & persistence | 0 (none) | There is no sudo, service installation, shell/profile editing, or other privilege-changing behavior. |
| Instruction hijack surface | 0 (none) | The prompt templates constrain analysis but do not include skip-confirmation, hidden, or externally fetched instructions. |
| Irreversible actions | 1 (low) | The skill autonomously spawns multiple scanning agents and then writes findings files without an extra human checkpoint. |
| Transparency | 0 (none) | All shipped artifacts are readable markdown plus a small SVG; there are no binaries, encoded blobs, or runtime-generated installers. |
Before installing
- Read `SKILL.md` Phase 1–4 to confirm it will write `CLAUDE.md` and finding files into your repo.
- Run it first in a scratch checkout if you do not want audit artifacts added to the working tree.
- Check the chosen output directory (default `.bughunt_cosmos/`) is inside the workspace and won’t overwrite anything important.
Rated 2026-10-19 by an automated review of 11 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner/SKILL.md
- Branch
- main
- Collection
- building-secure-contracts
- Updated
- 2026-09-19
Related skills
- algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
- cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
- solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
- substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
- token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist.
- ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts.