substrate-vulnerability-scanner

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, blockchain, polkadot, security, smart-contracts.

What it does

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill substrate-vulnerability-scanner

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner ~/.claude/skills/substrate-vulnerability-scanner

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a read-only audit skill for Substrate/FRAME pallets. Its main blast radius is running repo-local Rust builds/tests and, in the example try-runtime command, optionally contacting a public Polkadot RPC endpoint; it does not ship code that edits the host or accesses secrets.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill tells the agent to run workspace commands like `cargo test --features runtime-benchmarks`, `cargo build --release --features try-runtime`, and `./target/release/node benchmark pallet`, which executes project code but stays within the audited repo.
Network access	1 (low)	`resources/VULNERABILITY_PATTERNS.md` includes a live example `try-runtime ... --uri wss://rpc.polkadot.io`, which would connect to an external host if followed.
Filesystem reach	1 (low)	The workflow is scoped to reading `pallets/` and `runtime/lib.rs` and reviewing local Rust sources; there are no instructions to modify or delete files outside the working tree.
Secrets & credentials	0 (none)	The skill does not ask for tokens, keys, passwords, `.env` files, browser sessions, or other credentials.
Privilege & persistence	0 (none)	It does not request sudo, global installs, services, shell startup edits, or OS-level configuration changes.
Instruction hijack surface	0 (none)	I found no text that tries to override agent instructions, hide behavior, or fetch and obey remote prompts.
Irreversible actions	0 (none)	The skill only audits and reports; it does not push, deploy, publish, pay, merge, or delete anything.
Transparency	0 (none)	All shipped files are readable Markdown/YAML/SVG; there are no binaries, minified blobs, or decoded-at-runtime scripts.

Before installing

Read `SKILL.md` §8 and decide whether you want to use the live `wss://rpc.polkadot.io` example.
Run the skill in a scratch checkout if you do not want benchmark builds or try-runtime to touch your main working tree.
Confirm there are no new helper scripts or binaries in future updates to this skill repository.
If you use the benchmarking steps, make sure you are comfortable with compiling and executing the target project's Rust code.

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/building-secure-contracts/skills/substrate-vulnerability-scanner/SKILL.md
Branch: main
Collection: building-secure-contracts
Updated: 2026-09-19

algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist.
ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts.