Skip to main content
affpapa.org
RU EN
skill CX Codex

cosmos-vulnerability-scanner — Claude Code skill: Cosmos SDK audit

Finds vulnerabilities in Cosmos SDK modules and CosmWasm contracts that halt a chain or drain funds. Useful before a network goes live.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code
Open on GitHub

What cosmos-vulnerability-scanner does

The skill spawns several scanning agents in parallel, each with its own set of vulnerability patterns, and the main skill writes their findings as individual markdown files into .bughunt_cosmos/. Name a different directory in your prompt and the output goes there instead.

Discovery runs first: a synchronous subagent explores the codebase and returns the versions from go.mod, the list of x/* modules, whether IBC is enabled and which platforms are present. From that the main skill writes CLAUDE.md to the repo root and decides which scanners to launch. Three agents always run — core, state and advanced patterns; the EVM, IBC and CosmWasm scanners join only when discovery found that platform.

Patterns are tied to SDK versions, and that matters: v0.47 dropped GetSigners, v0.50 brought ABCI 2.0, v0.53 deprecated ValidateBasic. Running the patterns without checking go.mod first gets you noise. The skill covers SDK modules, not the CometBFT consensus engine itself, and it is not a substitute for Solidity tooling.

What it helps with

  • catch non-determinism that makes validators compute different state roots
  • check msg_server handlers and AnteHandler for privilege gaps
  • assess an IBC integration before a channel is opened
  • trace a chain halt back to the code that caused it
  • filter out false positives in CLI and query code that never touches consensus

Example prompts for the agent

  • Scan x/staking for consensus-critical vulnerabilities and write findings to .bughunt_cosmos/
  • Review our IBC integrations and save each finding as a separate file in audit/
  • Run a pre-launch security assessment: discovery first, then the parallel scanners

How to install cosmos-vulnerability-scanner

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code

2Manually: put the files in place

~/.claude/skills/cosmos-vulnerability-scanner/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/cosmos-vulnerability-scanner/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about cosmos-vulnerability-scanner

How do I install cosmos-vulnerability-scanner in Claude Code?

Run npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code. The skill lands at ~/.claude/skills/cosmos-vulnerability-scanner/SKILL.md.

What does cosmos-vulnerability-scanner do?

It scans Cosmos SDK modules and CosmWasm contracts for flaws that cause chain halts, state divergence or fund loss. Findings are saved as separate markdown files.

Which Cosmos SDK versions are supported?

The patterns are updated for SDK v0.53.x, and the skill checks versions in go.mod before applying them. Differences between v0.47, v0.50 and v0.53 shape which checks run.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set77

guidelines-advisor Audits smart contract codebases against Trail of Bits guidelines. It spots upgradeability pitfalls, flawed inheritance, and testing gaps. CX Codex +1 5,500installs coverage-analysis Measures code reached by a fuzzing campaign and helps explain stalled path discovery. Use it to inspect harness changes, corpus results, and unreachable branches. CX Codex +1 5,500installs fuzzing-dictionary Generates and connects token dictionaries for parsers and protocols in libFuzzer or AFL++ when coverage stalls on initial checks. CX Codex +1 5,300installs semgrep-rule-variant-creator Ports completed Semgrep rules to selected languages and creates separate rule and test directories. Use it when you already have a rule to adapt. CX Codex +1 5,300installs fuzzing-obstacles Patches anti-fuzzing patterns like checksums and time-seeded PRNGs in C, C++, and Rust. Useful when fuzzers get stuck on early validation checks. CX Codex +1 5,300installs address-sanitizer This skill gives an agent a routine for building code with -fsanitize=address, reading ASan reports and freeing the fuzzer from memory caps. Aimed at C/C++ and Rust with unsafe blocks. CX Codex +1 5,400installs substrate-vulnerability-scanner Scans Substrate and Polkadot pallets for 7 critical vulnerabilities such as panic DoS and integer overflow. Useful when auditing FRAME runtimes before mainnet launch. CX Codex +1 5,200installs atheris Guides setup of coverage-guided fuzzing for Python code and C extensions with Atheris. Use it to investigate crashes and memory corruption. CX Codex +1 5,200installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor