# cosmos-vulnerability-scanner

Finds vulnerabilities in Cosmos SDK modules and CosmWasm contracts that halt a chain or drain funds. Useful before a network goes live.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5300 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/cosmos-vulnerability-scanner

## What it does

The skill spawns several scanning agents in parallel, each with its own set of vulnerability patterns, and the main skill writes their findings as individual markdown files into `.bughunt_cosmos/`. Name a different directory in your prompt and the output goes there instead.

Discovery runs first: a synchronous subagent explores the codebase and returns the versions from `go.mod`, the list of `x/*` modules, whether IBC is enabled and which platforms are present. From that the main skill writes `CLAUDE.md` to the repo root and decides which scanners to launch. Three agents always run — core, state and advanced patterns; the EVM, IBC and CosmWasm scanners join only when discovery found that platform.

Patterns are tied to SDK versions, and that matters: v0.47 dropped `GetSigners`, v0.50 brought ABCI 2.0, v0.53 deprecated `ValidateBasic`. Running the patterns without checking `go.mod` first gets you noise. The skill covers SDK modules, not the CometBFT consensus engine itself, and it is not a substitute for Solidity tooling.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/cosmos-vulnerability-scanner/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/cosmos-vulnerability-scanner/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/cosmos-vulnerability-scanner/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/cosmos-vulnerability-scanner/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills cosmos-vulnerability-scanner
```

2. **Manually: put the files in place**
- File: `.github/skills/cosmos-vulnerability-scanner/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/cosmos-vulnerability-scanner/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner/SKILL.md

## When to use it
- catch non-determinism that makes validators compute different state roots
- check `msg_server` handlers and `AnteHandler` for privilege gaps
- assess an IBC integration before a channel is opened
- trace a chain halt back to the code that caused it
- filter out false positives in CLI and query code that never touches consensus

## Example prompts
- Scan `x/staking` for consensus-critical vulnerabilities and write findings to `.bughunt_cosmos/`
- Review our IBC integrations and save each finding as a separate file in `audit/`
- Run a pre-launch security assessment: discovery first, then the parallel scanners

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md