New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Cosmos Vulnerability Scanner

by trailofbits in trailofbits/skills

Scans Cosmos SDK modules and CosmWasm contracts for consensus-critical flaws that can halt a chain, lose funds or diverge state, using parallel scanning agents.

OfficialCC-BY-SA-4.0Auto-check passedSecurity

Install Cosmos Vulnerability Scanner

skills CLI
$ npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trailofbits/skills cosmos-vulnerability-scanner --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner .claude/skills/cosmos-vulnerability-scanner && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
cosmos-vulnerability-scanner
GitHub stars
7.4k
Token cost
~2.7k tokens
SKILL.md length
851 words
Files
11 (incl. assets)
Skills in repo
79
Repo updated
First seen
Licence
CC-BY-SA-4.0

At a glance

Scans Cosmos SDK modules and CosmWasm contracts for consensus-critical flaws that can halt a chain, lose funds or diverge state, using parallel scanning agents.

  • Works in 4 steps: Discovery (synchronous) → Parallel Vulnerability Scan → Write Findings → …
  • Auditing custom x/ modules in a Cosmos SDK chain
  • SKILL.md covers Purpose, When to Use, When NOT to Use and Essential Principles, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

The scan starts with a synchronous discovery phase, then spawns parallel agents that each specialize in a vulnerability category. They return findings to the main skill, which writes each as its own markdown file in an output directory, .bughunt_cosmos/ by default or one you name. Pattern sets cover 25 core, 16 IBC, 10 EVM and 3 CosmWasm issues.

Guiding principles: a bug matters only if it is reachable from the consensus path (BeginBlock, EndBlock, FinalizeBlock, message server handlers, the AnteHandler); non-determinism that changes state roots halts every validator; SDK versions in go.mod are checked before applying patterns; and false positives such as map iteration in a CLI command are avoided. It is not for pure Solidity audits, CometBFT internals or general Go review.

When your agent uses it

  • Auditing custom x/ modules in a Cosmos SDK chain
  • Reviewing IBC integrations and CosmWasm contracts
  • Assessing chain security before a launch
  • Investigating a chain halt incident

Example prompts

  • “Scan our x/ modules for anything that could halt the chain.”
  • “Review the IBC handlers in this repo for reentrancy and state desync, and write the findings to ./audit-out.”
  • “Audit this CosmWasm contract using the CosmWasm checklist items.”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Discovery (synchronous)
  2. Parallel Vulnerability Scan
  3. Write Findings
  4. Verify Completeness

What it can do on your machine

Read from SKILL.md and the folder at commit 82fe822. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • docs.cosmos.network
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cosmos Vulnerability Scanner loads about 2.7k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 851 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~2.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trailofbits/skills at commit 82fe822, republished under its CC-BY-SA-4.0 licence (© trailofbits). 851 words, ~2,719 tokens.

Download SKILL.mdSave it as .claude/skills/cosmos-vulnerability-scanner/SKILL.md (or your agent's skills folder). This skill also uses 10 other files; get the full folder from GitHub.
name
cosmos-vulnerability-scanner
description
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

Cosmos Vulnerability Scanner

Purpose

Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents — each specializing in a vulnerability category — that return findings to the main skill, which then writes them as individual markdown files to an output directory.

Output directory: defaults to .bughunt_cosmos/. If the user specifies a different directory in their prompt, use that instead.

When to Use

  • Auditing Cosmos SDK modules (custom x/ modules)
  • Reviewing CosmWasm smart contracts
  • Pre-launch security assessment of Cosmos chains
  • Investigating chain halt incidents

When NOT to Use

  • Pure Solidity/EVM audits without Cosmos SDK — use Solidity-specific tools
  • CometBFT consensus engine internals — this covers SDK modules, not the consensus layer itself
  • General Go code review with no blockchain context
  • Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints)
  • CosmWasm contract-only audits on chains without custom SDK modules — use the CosmWasm checklist items alone

Essential Principles

  1. Consensus path is king — A bug only matters for chain halt/fund loss if it's on the consensus-critical execution path (BeginBlock, EndBlock, FinalizeBlock, msg_server handlers, AnteHandler). Always verify a finding is reachable from consensus before reporting it.
  2. State divergence = chain halt — Any non-determinism that causes validators to compute different state roots will halt the chain. This is the highest-severity class because it affects all validators simultaneously.
  3. Check the version — Cosmos SDK has breaking changes across major versions (v0.47 removed GetSigners, v0.50 added ABCI 2.0, v0.53 deprecated ValidateBasic). Always check go.mod versions before applying patterns.
  4. False positives waste audit time — A map iteration in a CLI command is not a consensus bug. A panic in a query handler does not halt the chain. Verify the execution context before flagging.
  5. Cross-module interactions are where bugs hide — The most severe findings (IBC reentrancy, EVM/Cosmos state desync, authz escalation) involve interactions between modules, not bugs within a single module.

Scanning Workflow

Phase 1: Discovery (synchronous)

Entry: Target codebase path provided by user. Codebase contains Go source (e.g., x/ modules, go.mod) or Rust contracts with cosmwasm_std.

Run a synchronous subagent (Agent tool) with the full contents of DISCOVERY.md as its prompt. The agent must:

  1. Follow the Discovery workflow to explore the target codebase
  2. Return the full CLAUDE.md content (the technical inventory and threat model) in its response
  3. Return a structured summary with exactly these fields:
PLATFORM: pure-cosmos | evm | wasm        (pick one; if multiple, comma-separated)
IBC_ENABLED: true | false
SDK_VERSION: <version from go.mod>
IBC_GO_VERSION: <version from go.mod, or "n/a">
CUSTOM_MODULES: <comma-separated list of x/* modules>

After the subagent returns, you (the main skill) Write the CLAUDE.md to the target repo root. Save its path and the discovery values — these feed into Phase 2.

Exit: CLAUDE.md written by main skill. PLATFORM, IBC_ENABLED, SDK_VERSION, IBC_GO_VERSION, and CUSTOM_MODULES captured.

Phase 2: Parallel Vulnerability Scan

Spawn scanning agents in a single message for maximum parallelism. Use the Agent Prompt Template below, filling in the reference file for each agent. Subagents only need read access (Grep, Glob, Read) — they return findings in their response and the main skill writes the files.

Always spawn these 3 agents:

Agent NameReference FileScope
core-scannerVULNERABILITY_PATTERNS.md§1-9: non-determinism, ABCI, signers, validation, handlers, ante security
state-scannerSTATE_VULNERABILITY_PATTERNS.md§11-23: bookkeeping, bank, pagination, events, tx replay, governance, arithmetic, encoding, deprecated modules
advanced-scannerADVANCED_VULNERABILITY_PATTERNS.md§24-27: storage keys, consensus validation, circuit breaker, crypto

Spawn conditionally (in the same parallel message):

Agent NameConditionReference File
evm-scannerPLATFORM includes evmEVM_VULNERABILITY_PATTERNS.md
ibc-scannerIBC_ENABLED is trueIBC_VULNERABILITY_PATTERNS.md
cosmwasm-scannerPLATFORM includes wasmCOSMWASM_VULNERABILITY_PATTERNS.md
Show full SKILL.md (295 more words)Show less
Agent Prompt Template

Construct each agent's prompt by replacing {REFERENCE_FILE_PATH} with the full path to the reference file (under {baseDir}/resources/) and {CLAUDE_MD_PATH} with the path to the CLAUDE.md written in Phase 1:

Perform a very thorough security scan of a Cosmos SDK codebase for specific vulnerability patterns.

CONTEXT:
Read {CLAUDE_MD_PATH} for codebase context (SDK version, modules, threat model, key files).

PATTERNS:
Read {REFERENCE_FILE_PATH} — it contains numbered vulnerability patterns. For EACH pattern:
1. Read the detection patterns and "What to Check" items
2. Use Grep and Glob to search the target codebase for each pattern
3. When a match is found, Read surrounding code to verify it's on a consensus-critical path (BeginBlock, EndBlock, FinalizeBlock, msg_server handlers, AnteHandler)
4. Classify severity per the guidelines below

RULES:
- Consensus path only: Only flag code reachable from consensus-critical execution. CLI/query/test code is NOT a finding.
- Check SDK version in go.mod before applying patterns (v0.47 removed GetSigners, v0.50 added ABCI 2.0, v0.53 deprecated ValidateBasic).
- Always use the Grep tool for searches, not bash grep. The reference file contains search patterns — use them directly with the Grep tool.
- Ignore cross-references to other resource files (e.g., links to IBC or COSMWASM patterns). Those patterns are covered by other scanning agents.
- Reject these rationalizations:
  - "ValidateBasic catches this" — deprecated and facultative since SDK v0.53
  - "Behind governance, so safe" — governance proposals can be malicious
  - "IBC counterparty is trusted" — any chain can open a channel
  - "Panic can't happen, input is validated" — trace the full call chain
  - "Rounding error is only a few tokens" — compounds over time, can be looped
  - "EVM precompile handles rollback" — many have incomplete rollback

SEVERITY:
- Critical (fund loss): signer mismatch, broken bookkeeping, AnteHandler bypass, bank keeper misuse, IBC token inflation, EVM/Cosmos desync, Merkle proof forgery, arithmetic overflow
- High (chain halt): non-determinism, ABCI panics, slow ABCI, non-deterministic IBC acks, consensus gaps, CacheContext event leak
- Medium (DoS): unbounded pagination, tx replay, missing validation, governance spam, rate limiting, circuit breaker bypass, storage key collisions
- Low (logic): rounding errors, stub handlers, event override, module ordering

OUTPUT — RETURN FORMAT:
Do NOT write any files. Return ALL findings and the summary in your response.

For each pattern, return one of:
  §NUM PATTERN_NAME: Not applicable — [one-line reason]
  §NUM PATTERN_NAME: FINDING (followed by the finding block below)

For each finding, include the full content using this template:

FINDING_FILE: {SEVERITY}-s{SECTION_NUM}-{kebab-description}.md
## [SEVERITY] Title
**Location**: `file:line`
**Description**: What the bug is and why it matters
**Vulnerable Code**: [snippet]
**Attack Scenario**: [numbered steps]
**Recommendation**: How to fix
**References**: [links to relevant advisories or building-secure-contracts]

You MUST report on ALL patterns in the reference file — do not skip any.

Exit: All scanning agents returned. Each reported on every pattern in their reference file.

Phase 3: Write Findings

After all scanning agents return, write finding files to the output directory (default .bughunt_cosmos/):

  1. Parse each agent's response for FINDING_FILE: blocks
  2. For each finding, Write the content to {OUTPUT_DIR}/{filename} using the filename from FINDING_FILE:
  3. Create the output directory first if it doesn't exist
Phase 4: Verify Completeness

After writing all findings, verify every pattern was assessed:

  1. Collect the summary lines (§NUM entries) returned by each agent
  2. Check pattern counts against expected totals:
    • core-scanner: 8 patterns (§1-9, excluding §8 legacy-only)
    • state-scanner: 13 patterns (§11-23)
    • advanced-scanner: 4 patterns (§24-27)
    • evm-scanner (if spawned): 10 patterns (§1-10)
    • ibc-scanner (if spawned): 16 patterns (§1-16)
    • cosmwasm-scanner (if spawned): 3 patterns (§1-3)
  3. If any pattern is missing from a summary, flag it and re-prompt that agent
  4. List all finding files written to the output directory with a Glob for *.md

Exit: All patterns accounted for. Finding files listed for the user.

Success Criteria

  • Discovery CLAUDE.md written with complete technical inventory and threat model
  • All scanning agents completed and reported on every pattern in their reference file
  • Pattern counts verified against expected totals (no patterns skipped)
  • All findings written to output directory as individual markdown files
  • Each finding file includes: severity, location, vulnerable code, attack scenario, recommendation

Resources

© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 10 other files (assets) in plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner of trailofbits/skills.

  • SKILL.md
  • CHANGELOG.md
  • agents/openai.yaml
  • assets/trail-of-bits-mark.svg
  • resources/ADVANCED_VULNERABILITY_PATTERNS.md
  • resources/COSMWASM_VULNERABILITY_PATTERNS.md
  • resources/DISCOVERY.md
  • resources/EVM_VULNERABILITY_PATTERNS.md
  • resources/IBC_VULNERABILITY_PATTERNS.md
  • resources/STATE_VULNERABILITY_PATTERNS.md
  • resources/VULNERABILITY_PATTERNS.md

Open the folder on GitHubat commit 82fe822

Compare with similar skills

Cosmos Vulnerability Scanner next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cosmos Vulnerability Scanner compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Cosmos Vulnerability Scanner this skilltrailofbits/skills7.4k—~2.7kAutomated safety check: PassCC-BY-SA-4.0
Ghost Scan Depsghostsecurity/skills408—~1.3kAutomated safety check: NotesApache-2.0
Time Aware Dependency Cve ScannerArabelaTso/Skills-4-SE253—~2.1kAutomated safety check: PassApache-2.0
Ethereum Smart Contract Vulnerability Analysistradecatlabs/vibe-coding-cn17k1 repos~738Automated safety check: PassApache-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Deepsec Vulnerability Scannervercel-labs/deepsec8.1k—~1.2kAutomated safety check: PassApache-2.0

Similar skills

  • Ghost Scan Deps

    ghostsecurity/skills

    Ghost Security - Software Composition Analysis (SCA) scanner.

    408 GitHub stars~1.3k tokensUpdated 10 days ago
    SecurityAuto-check: notes

  • Time Aware Dependency Cve Scanner

    ArabelaTso/Skills-4-SE

    Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date.

    253 GitHub stars~2.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Ethereum Smart Contract Vulnerability Analysis

    tradecatlabs/vibe-coding-cn

    Runs Slither and Mythril against Solidity contracts to find reentrancy, overflow and access-control bugs before mainnet deployment, then triages and reports findings.

    17k GitHub starsUsed in 1 repo~738 tokens
    SecurityAuto-check passed

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

  • Deepsec Vulnerability Scanner

    vercel-labs/deepsec

    Official

    Runs deepsec's AI-powered security scan over a repository's uncommitted changes, its diff to main, or the whole codebase, using a regex pass followed by agent investigation.

    8.1k GitHub stars~1.2k tokensUpdated 9 days ago
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    893 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

More from trailofbits/skills

All 79 skills in this repo

  • Code Graph Mermaid Diagrams

    trailofbits/skills

    Official

    Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.

    7.4k GitHub starsUsed in 1 repo~1.7k tokens
    Auto-check passed

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated today
    Auto-check: notes

  • Trailmark Graph Evolution

    trailofbits/skills

    Official

    Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

    7.4k GitHub stars~3.4k tokensUpdated today
    Auto-check passed

  • Let Fate Decide

    trailofbits/skills

    Official

    Draws a 12 Houses tarot spread to break ties when a request is vague or casually delegated, then reads the cards to pick the next step.

    7.4k GitHub stars~2.5k tokensUpdated today
    Auto-check: notes

  • Burp Suite Project Parser

    trailofbits/skills

    Official

    Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.

    7.4k GitHub starsUsed in 4 repos~4.2k tokens
    Auto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated today
    Auto-check: notes

Works with

Categories

Questions about Cosmos Vulnerability Scanner

What does Cosmos Vulnerability Scanner do?

Scans Cosmos SDK modules and CosmWasm contracts for consensus-critical flaws that can halt a chain, lose funds or diverge state, using parallel scanning agents. The scan starts with a synchronous discovery phase, then spawns parallel agents that each specialize in a vulnerability category.bughunt_cosmos/ by default or one you name.

When should I use Cosmos Vulnerability Scanner?

Cosmos Vulnerability Scanner fits situations like: auditing custom x/ modules in a Cosmos SDK chain; reviewing IBC integrations and CosmWasm contracts; assessing chain security before a launch; investigating a chain halt incident.

How do I install Cosmos Vulnerability Scanner in Claude Code?

Run `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code`. Or copy the skill folder (plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner in trailofbits/skills) into .claude/skills/cosmos-vulnerability-scanner in your project. Claude Code loads it when a task matches its description.

How do I install Cosmos Vulnerability Scanner in Codex?

Run `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a codex`. Or copy the skill folder (plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner in trailofbits/skills) into .agents/skills/cosmos-vulnerability-scanner in your project. Codex loads it when a task matches its description.

Can I use Cosmos Vulnerability Scanner in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cosmos-vulnerability-scanner, .gemini/skills/cosmos-vulnerability-scanner, .github/skills/cosmos-vulnerability-scanner and .opencode/skills/cosmos-vulnerability-scanner in your project.

What does Cosmos Vulnerability Scanner need to run?

SKILL.md names no scripts, command-line tools or credentials: Cosmos Vulnerability Scanner is instructions for the agent only.

Does Cosmos Vulnerability Scanner access the network?

SKILL.md names 2 domains. As links in the text: docs.cosmos.network and github.com. This is read from the text; nothing was executed.

Is Cosmos Vulnerability Scanner safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cosmos Vulnerability Scanner use?

Cosmos Vulnerability Scanner is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cosmos Vulnerability Scanner use?

About 2.7k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cosmos Vulnerability Scanner?

Skills that share tags, products or a category with Cosmos Vulnerability Scanner: Ghost Scan Deps (ghostsecurity/skills, 408 stars), Time Aware Dependency Cve Scanner (ArabelaTso/Skills-4-SE, 253 stars), Ethereum Smart Contract Vulnerability Analysis (tradecatlabs/vibe-coding-cn, 17k stars) and Security Auditor (eigent-ai/eigent, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cosmos Vulnerability Scanner?

trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills, which has 7,420 GitHub stars. The repository holds 79 skills in this directory. The repository was last updated on October 7, 2026.

Source: trailofbits/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.