substrate-vulnerability-scanner — Claude Code skill: how to install
Scans Substrate and Polkadot pallets for 7 critical vulnerabilities such as panic DoS and integer overflow. Useful when auditing FRAME runtimes before mainnet launch.
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a claude-codeWhat substrate-vulnerability-scanner does
The skill scans repository trees for FRAME pallet files in pallets/*/lib.rs and runtime setups in runtime/lib.rs. It expects Rust projects with frame-* dependencies in Cargo.toml. It inspects every dispatchable function. The review flags unhandled panics from unwrap() or raw indexing, permissive ensure_signed calls on privileged methods, and weak randomness from pallet_randomness_collective_flip.
Direct arithmetic operators wrap silently in release mode. In blockchain runtimes, unchecked math risks corrupting token accounting. For Substrate releases prior to v0.9.25, the scanner also checks whether storage mutations happen before validation checks without a #[transactional] macro.
The audit finishes with an overview table covering all 7 vulnerability categories. Each row marks a verdict such as found with a code location, or clear. The skill also generates remediation steps for every detected issue.
What it helps with
- catch missing
checked_*andsaturating_*arithmetic operations - locate node-crashing panics from
unwrapand array indexing - verify privileged call authorization against missing
ensure_root - detect storage mutations executed before input validation
Example prompts for the agent
- Scan all pallets in pallets/ for the 7 Substrate vulnerability patterns
- Audit #[pallet::call] functions in my runtime before launching the chain
- Check runtime code for unwrap panics and unchecked arithmetic
How to install substrate-vulnerability-scanner
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a claude-code2Manually: put the files in place
~/.claude/skills/substrate-vulnerability-scanner/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/substrate-vulnerability-scanner/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a codex2Manually: put the files in place
.agents/skills/substrate-vulnerability-scanner/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a cursor2Manually: put the files in place
.cursor/skills/substrate-vulnerability-scanner/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills substrate-vulnerability-scanner2Manually: put the files in place
.github/skills/substrate-vulnerability-scanner/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/building-secure-contracts/skills/substrate-vulnerability-scannerManually: put the files in place
.devin/skills/substrate-vulnerability-scanner/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about substrate-vulnerability-scanner
How to install substrate-vulnerability-scanner in Claude Code?
Run npx skills add trailofbits/skills --skill substrate-vulnerability-scanner -a claude-code.
What vulnerabilities does this skill scan for?
It detects 7 specific Substrate flaws: arithmetic overflows, panic DoS from unwrap or index access, incorrect transaction weights, storage writes before validation, insecure unsigned transactions, weak collective-flip randomness, and improper origin validation.
Why does the scanner check storage write order on older Substrate versions?
Before Substrate v0.9.25, storage writes were not automatically rolled back on error. Unless wrapped in #[transactional], mutations that occur prior to a validation failure persist in storage.
