cairo-vulnerability-scanner

Name: cairo-vulnerability-scanner
Availability: InStock
Author: ayehiaa

Scan Cairo/StarkNet contracts for six vulnerability classes with evidence-based reports.

Updated May 2, 2026

Search Tags:#vulnerability scanning #cairo #starknet #smart contract audit #signature replay #l1-handler #bridge security

Ready to run

npx skills add https://github.com/ayehiaa/my-travel-assistant --skill cairo-vulnerability-scanner-ayehiaa

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cairo-vulnerability-scanner
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/cairo-vulnerability-scanner
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill cairo-vulnerability-scanner-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires caracal, and includes references (resource) components.

What problem does it solve?

This Skill helps you identify critical security weaknesses in Cairo/StarkNet smart contracts before deployment, reducing the risk of exploitable arithmetic, broken L1↔L2 message flows, and signature-related attacks.

Core Features & Use Cases

Cairo/StarkNet vulnerability scanning focused on 6 high-impact patterns relevant to the ecosystem (e.g., unchecked felt252 arithmetic and L1 handler sender validation).
L1-L2 interaction analysis that reviews #[l1_handler] logic, address conversion assumptions, and bridge-style message handling risks.
Signature replay & nonce review that checks for proper nonce tracking and domain separation to prevent replay attacks.
Tool-assisted analysis guidance using Caracal detectors and a recommended workflow for producing a structured findings report.

Quick Start

Ask the AI to scan your StarkNet codebase for Cairo files and produce a severity-ranked vulnerability report with concrete remediation suggestions.

Frequently Asked Questions about cairo-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit StarkNet smart contracts for vulnerability scanning?▼

Perform vulnerability scanning on StarkNet contracts by discovering Cairo files and detecting six high-impact vulnerability patterns including unchecked felt252 arithmetic and L1 handler sender validation, generating a severity-ranked findings report.

What is signature replay vulnerability detection in Cairo contracts?▼

Signature replay detection in Cairo contracts reviews signature verification logic for proper nonce tracking and domain separation to prevent replay attacks during StarkNet security audits.

How does L1 handler security analysis work for StarkNet bridge contracts?▼

L1 handler security analysis reviews #[l1_handler] logic, address conversion assumptions, and bridge-style message handling risks to identify broken L1-L2 message flows in Cairo codebases.

Can I use Caracal detectors for Cairo smart contract audits?▼

Yes, you can use Caracal detectors for Cairo smart contract audits to guide tool-assisted analysis and produce a structured findings report for StarkNet deployments.

Does vulnerability scanning support pre-launch assessments for contracts with l1_handler functions?▼

Yes, vulnerability scanning supports pre-launch assessments for contracts containing .cairo sources and #[l1_handler] or signature verification logic, applying pattern-based detection across six vulnerability classes.

What are common unchecked felt252 arithmetic vulnerabilities in StarkNet?▼

Unchecked felt252 arithmetic vulnerabilities in StarkNet involve missing bounds checks in Cairo smart contracts where arithmetic operations risk exploitable overflow conditions before deployment.