solana-vulnerability-scanner

Scans Solana and Anchor programs for six critical vulnerability patterns.

Updated Feb 24, 2026
One-click install
npx skills add https://github.com/ofelixdev/cc-kit --skill solana-vulnerability-scanner-ofelixdev
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: solana-vulnerability-scanner
Source: https://github.com/ofelixdev/cc-kit/tree/main/template/skills/solana-vulnerability-scanner
Command: npx skills add https://github.com/ofelixdev/cc-kit --skill solana-vulnerability-scanner-ofelixdev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill systematically scans Solana programs for critical security vulnerabilities, helping developers identify and fix potential exploits before deployment.

Core Features & Use Cases

  • Vulnerability Detection: Identifies 6 critical vulnerability patterns specific to Solana's architecture (Arbitrary CPI, Improper PDA Validation, etc.).
  • Code Auditing: Provides detailed analysis, reporting, and remediation advice for identified issues.
  • Use Case: When auditing a new Solana DeFi protocol, use this Skill to perform an initial security scan of the smart contracts to catch common vulnerabilities.

Quick Start

Use the solana-vulnerability-scanner skill to audit the provided Solana program code for security flaws.

Frequently Asked Questions about solana-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Solana smart contract for common vulnerabilities?

Auditing Solana smart contracts involves scanning Rust code for six critical security anti-patterns including arbitrary CPI and sysvar spoofing, providing detailed analysis and remediation guidance to fix identified issues.

What security anti-patterns should I look for in Solana Rust programs?

Security anti-patterns in Solana Rust programs include arbitrary CPI, improper PDA validation, missing signer checks, missing ownership checks, and sysvar spoofing, all of which can lead to critical protocol exploits.

Can I use an automated scanner to detect missing signer checks in Anchor programs?

Yes, you can scan Anchor programs to detect missing signer checks by analyzing Rust code for specific security anti-patterns, providing targeted remediation advice for the identified vulnerabilities.

Does this Solana vulnerability scanner check for improper PDA validation?

Yes, the Solana vulnerability scanner checks for improper PDA validation along with five other critical vulnerability patterns specific to Solana's architecture, helping secure programs before deployment.

What is the best way to secure a Solana DeFi protocol before deployment?

Securing a Solana DeFi protocol before deployment involves performing an initial security scan of smart contracts to catch common vulnerabilities like arbitrary CPI and missing ownership checks.

Are there limitations to automated Rust code analysis for Solana program vulnerabilities?

Automated Rust code analysis for Solana vulnerabilities targets six specific anti-patterns; it may not detect complex business logic flaws or novel exploit vectors outside its predefined security scanning rules.