Skip to main content
affpapa.org
RU EN
skill CX Codex

solana-vulnerability-scanner — Claude Code skill: how to install

Detects 6 critical vulnerabilities across native Rust and Anchor programs on Solana. Helps identify flaws in account validation, PDA derivation, and CPI logic.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill solana-vulnerability-scanner -a claude-code
Open on GitHub

What solana-vulnerability-scanner does

The tool searches repository files for Rust sources and Anchor.toml configs. It checks code against six security patterns in the Solana execution model. These include unverified program IDs during CPI calls and improper bump calculations in PDA seeds.

The scan produces a coverage summary listing every tested pattern. The report highlights missing ownership checks prior to data decoding and omitted signer checks. Ready-to-use code fixes accompany each finding.

The sysvar rule targets projects using solana-program releases older than 1.8.1. Without Rust sources or Anchor definitions, the scanner will find nothing to evaluate.

What it helps with

  • detect arbitrary cross-program invocation flaws with unverified targets
  • verify account deserialization logic against missing owner checks
  • spot program-derived address derivation using arbitrary bumps
  • flag state modifications missing signer authentication

Example prompts for the agent

  • Scan programs/ for unsafe cross-program invocations and unverified PDA derivations
  • Audit the Anchor accounts struct to ensure signer constraints are in place
  • Review Solana program instructions for instruction introspection flaws

How to install solana-vulnerability-scanner

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill solana-vulnerability-scanner -a claude-code

2Manually: put the files in place

~/.claude/skills/solana-vulnerability-scanner/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/solana-vulnerability-scanner/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about solana-vulnerability-scanner

How to install solana-vulnerability-scanner in Claude Code?

Run npx skills add trailofbits/skills --skill solana-vulnerability-scanner -a claude-code in your terminal. The configuration is placed at ~/.claude/skills/solana-vulnerability-scanner/SKILL.md.

What vulnerabilities does solana-vulnerability-scanner detect?

It checks six specific Solana weaknesses: arbitrary CPI targets, broken PDA bumps, unvalidated account owners, missing signer checks, spoofed sysvar inputs, and unsafe instruction introspection.

Does this skill require the Anchor framework?

No, it supports both Anchor and native Rust code using solana-program. The scanner adjusts its search depending on imports and attributes found in Cargo.toml and source files.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set77

spec-to-code-compliance Compares an implementation against technical whitepapers or protocol specifications to flag missing logic, deviations, and unrecorded behavior. CX Codex +1 5,800installs audit-prep-assistant Prepares codebases for external security reviews using Trail of Bits' checklist. It helps run static analysis, boost test coverage, and generate system documentation. CX Codex +1 5,700installs entry-point-analyzer Finds externally callable smart contract functions that change state and classifies their access level. Use it before an audit to map the attack surface. CX Codex +1 5,700installs semgrep-rule-creator A skill that walks you through creating custom Semgrep rules to detect security vulnerabilities and code patterns in your projects. Use it when you need static analysis tailored to your codebase. CX Codex +1 5,800installs token-integration-analyzer Checks ERC20 and ERC721 implementations plus code that integrates external tokens. Use it before accepting tokens with non-standard transfer or approval behaviour. CX Codex +1 5,500installs cargo-fuzz Sets up cargo-fuzz inside a Cargo-based Rust crate and walks through the harness, sanitizers and crash triage. CX Codex +1 5,400installs constant-time-analysis Inspects compiled assembly and bytecode for timing side-channels. It flags secret-dependent branches and variable-time operations in crypto routines. CX Codex +1 5,400installs harness-writing Helps you write and fix a fuzzing harness: map raw bytes onto API arguments, kill non-determinism, stop chasing crashes that never reproduce. CX Codex +1 5,400installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor