cairo-vulnerability-scanner

Name: cairo-vulnerability-scanner
Availability: InStock
Author: Ramprasad

Scan Cairo/StarkNet smart contracts for six vulnerability patterns using Caracal.

1|Updated Feb 17, 2026

Search Tags:#security #audit #smart contract #cairo #starknet #vulnerability scanner

Ready to run

npx skills add https://github.com/Ramprasad4121/srp --skill cairo-vulnerability-scanner-ramprasad4121

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cairo-vulnerability-scanner
Source: https://github.com/Ramprasad4121/srp/tree/main/skills-repos/trailofbits/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner
Command: npx skills add https://github.com/Ramprasad4121/srp --skill cairo-vulnerability-scanner-ramprasad4121

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires caracal, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for security in Cairo/StarkNet smart contracts by systematically identifying and reporting on 6 specific, high-impact vulnerabilities unique to the platform.

Core Features & Use Cases

Vulnerability Detection: Scans for issues like arithmetic overflow, L1-L2 messaging flaws, address conversion problems, and signature replay vulnerabilities.
Platform Specific: Tailored for Cairo smart contracts on StarkNet.
Use Case: When auditing a new StarkNet DeFi protocol, use this Skill to proactively find and fix potential exploits before deployment, ensuring the integrity of user funds and contract logic.

Quick Start

Use the cairo-vulnerability-scanner skill to scan the StarkNet project located in the current directory.

Frequently Asked Questions about cairo-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Cairo smart contracts for security vulnerabilities on StarkNet?▼

To scan Cairo smart contracts for vulnerabilities on StarkNet, use a static analyzer to detect arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay patterns before deploying your DeFi protocol.

What types of StarkNet vulnerabilities should I audit before deploying a bridge implementation?▼

When auditing StarkNet bridge implementations, check for L1-L2 messaging flaws, address conversion problems, and signature replay vulnerabilities. These platform-specific issues can compromise user funds and contract logic integrity during cross-layer interactions.

Do I need the Caracal static analyzer to detect Cairo vulnerability patterns?▼

Yes, deterministic detection of the six Cairo vulnerability patterns requires the Caracal static analyzer. It provides the systematic identification needed to find high-impact security issues unique to StarkNet smart contracts.

Can I audit StarkNet DeFi protocols for arithmetic overflow using automated scanning?▼

Yes, you can audit StarkNet DeFi protocols for arithmetic overflow using automated static analysis scanning. This proactively identifies exploit risks in Cairo smart contracts, ensuring the integrity of user funds before mainnet deployment.

What's the best way to find L1-L2 messaging flaws in Cairo contracts?▼

The best way to find L1-L2 messaging flaws in Cairo contracts is using a platform-specific vulnerability scanner. It systematically detects messaging issues alongside address conversion and signature replay vulnerabilities in StarkNet projects.

Are there limitations to deterministic vulnerability detection for StarkNet smart contracts?▼

Deterministic vulnerability detection for StarkNet smart contracts is limited to six specific patterns, including arithmetic overflow and L1-L2 messaging issues. It may not catch complex logic flaws or novel exploit vectors outside these defined categories.