substrate-vulnerability-scanner

Scan Substrate and FRAME pallets for seven critical vulnerability patterns.

Updated Jan 30, 2026
One-click install
npx skills add https://github.com/andrescardonas7/salchipapa-web --skill substrate-vulnerability-scanner-andrescardonas7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: substrate-vulnerability-scanner
Source: https://github.com/andrescardonas7/salchipapa-web/tree/main/.cursor/skills/substrate-vulnerability-scanner
Command: npx skills add https://github.com/andrescardonas7/salchipapa-web --skill substrate-vulnerability-scanner-andrescardonas7

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill systematically scans Substrate runtime modules (pallets) for platform-specific security vulnerabilities that can cause node crashes, DoS attacks, or unauthorized access.

Core Features & Use Cases

  • Vulnerability Detection: Identifies 7 critical vulnerability patterns unique to Substrate/FRAME (e.g., arithmetic overflow, panics, bad origin checks).
  • Code Auditing: Assists in auditing custom Substrate pallets and reviewing FRAME runtime code.
  • Use Case: When auditing a new custom pallet for a Polkadot parachain, use this Skill to automatically flag potential security risks like unchecked arithmetic operations or improper origin validation before deployment.

Quick Start

Scan the current Substrate codebase for critical security vulnerabilities.

Frequently Asked Questions about substrate-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Substrate pallet for security vulnerabilities?

Scan a Substrate pallet for security vulnerabilities by analyzing Rust code and pattern matching against known FRAME anti-patterns to detect arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.

What security vulnerabilities affect Polkadot runtime modules?

Security vulnerabilities affecting Polkadot runtime modules include arithmetic overflow, panic DoS, incorrect weights, and bad origin checks that can cause node crashes, DoS attacks, or unauthorized access.

Does this vulnerability scanner work with custom Substrate pallets?

Yes, this vulnerability scanner works with custom Substrate pallets by flagging potential security risks such as unchecked arithmetic operations and improper origin validation before parachain deployment.

How do I audit a FRAME runtime for arithmetic overflow and bad origin checks?

Audit a FRAME runtime for arithmetic overflow and bad origin checks by scanning Rust pallet code to pattern match against known Substrate security anti-patterns before deployment.

When do I need to run a Substrate runtime security audit?

Run a Substrate runtime security audit when deploying a new custom pallet for a Polkadot parachain to systematically flag potential platform-specific security risks before deployment.