cosmos-vulnerability-scanner

Detect nine vulnerability patterns in Cosmos SDK modules and CosmWasm contracts.

6.5k|561|Updated Jan 14, 2026
One-click install
npx skills add https://github.com/trailofbits/skills --skill cosmos-vulnerability-scanner-trailofbits
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cosmos-vulnerability-scanner
Source: https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner
Command: npx skills add https://github.com/trailofbits/skills --skill cosmos-vulnerability-scanner-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scans Cosmos SDK modules and CosmWasm contracts for platform-specific vulnerabilities that can cause chain halts, fund loss, or governance issues, enabling proactive remediation.

Core Features & Use Cases

  • Detects 9 vulnerability patterns unique to Cosmos-based chains, including non-determinism, incorrect signers, and ABCI panics.
  • Audits Cosmos SDK modules, CosmWasm smart contracts, and ABCI method implementations to identify risk points.
  • Provides actionable, deterministic reporting with recommended fixes and mitigations for secure deployments.

Quick Start

Run the cosmos-vulnerability-scanner against your Cosmos-based codebase to generate a vulnerability report.

Frequently Asked Questions about cosmos-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Cosmos SDK modules for security vulnerabilities?

To scan Cosmos SDK modules for security vulnerabilities, apply an automated scanner to your codebase to identify risk points and generate a deterministic report with recommended fixes. This process catches consensus-critical issues across modules and ABCI implementations.

What is the best way to audit CosmWasm contracts for chain halt risks?

The best way to audit CosmWasm contracts for chain halt risks is using a specialized Cosmos security scanner. It identifies platform-specific vulnerability patterns like non-determinism and ABCI panics, providing actionable mitigations for secure deployments.

Does this Cosmos vulnerability scanner detect non-determinism and ABCI panics?

Yes, this Cosmos vulnerability scanner detects non-determinism and ABCI panics. It codifies nine vulnerability patterns unique to Cosmos-based chains, including incorrect signers and governance issues, to prevent fund loss and chain halts.

Can I use this scanner for pre-launch security assessments of Cosmos chains?

Yes, you can use this scanner for pre-launch security assessments of Cosmos chains. It audits Cosmos SDK modules, CosmWasm smart contracts, and ABCI method implementations to identify risk points and enable proactive remediation before deployment.

How do I generate a deterministic vulnerability report for a Cosmos codebase?

You generate a deterministic vulnerability report for a Cosmos codebase by running the automated scanner against it. The reporting workflow provides consistent, actionable outputs with recommended fixes and mitigations for identified vulnerabilities.

What types of consensus-critical issues can a CosmWasm and Cosmos SDK audit catch?

A CosmWasm and Cosmos SDK audit can catch consensus-critical issues such as non-determinism, incorrect signers, and ABCI panics. It identifies platform-specific vulnerabilities across nine patterns that could cause chain halts, fund loss, or governance issues.