cosmos-vulnerability-scanner

Detect nine vulnerability patterns in Cosmos SDK modules and CosmWasm contracts.

6.5k|561|Updated Jan 14, 2026
One-click install
npx skills add https://github.com/trailofbits/skills --skill cosmos-vulnerability-scanner-trailofbits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cosmos-vulnerability-scanner
Source: https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner
Command: npx skills add https://github.com/trailofbits/skills --skill cosmos-vulnerability-scanner-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scans Cosmos SDK modules and CosmWasm contracts for platform-specific vulnerabilities that can cause chain halts, fund loss, or governance issues, enabling proactive remediation.

Core Features & Use Cases

  • Detects 9 vulnerability patterns unique to Cosmos-based chains, including non-determinism, incorrect signers, and ABCI panics.
  • Audits Cosmos SDK modules, CosmWasm smart contracts, and ABCI method implementations to identify risk points.
  • Provides actionable, deterministic reporting with recommended fixes and mitigations for secure deployments.

Quick Start

Run the cosmos-vulnerability-scanner against your Cosmos-based codebase to generate a vulnerability report.

Frequently Asked Questions about cosmos-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Cosmos SDK modules for security vulnerabilities?▼

To scan Cosmos SDK modules for security vulnerabilities, apply an automated scanner to your codebase to identify risk points and generate a deterministic report with recommended fixes. This process catches consensus-critical issues across modules and ABCI implementations.

What is the best way to audit CosmWasm contracts for chain halt risks?▼

The best way to audit CosmWasm contracts for chain halt risks is using a specialized Cosmos security scanner. It identifies platform-specific vulnerability patterns like non-determinism and ABCI panics, providing actionable mitigations for secure deployments.

Does this Cosmos vulnerability scanner detect non-determinism and ABCI panics?▼

Yes, this Cosmos vulnerability scanner detects non-determinism and ABCI panics. It codifies nine vulnerability patterns unique to Cosmos-based chains, including incorrect signers and governance issues, to prevent fund loss and chain halts.

Can I use this scanner for pre-launch security assessments of Cosmos chains?▼

Yes, you can use this scanner for pre-launch security assessments of Cosmos chains. It audits Cosmos SDK modules, CosmWasm smart contracts, and ABCI method implementations to identify risk points and enable proactive remediation before deployment.

How do I generate a deterministic vulnerability report for a Cosmos codebase?▼

You generate a deterministic vulnerability report for a Cosmos codebase by running the automated scanner against it. The reporting workflow provides consistent, actionable outputs with recommended fixes and mitigations for identified vulnerabilities.

What types of consensus-critical issues can a CosmWasm and Cosmos SDK audit catch?▼

A CosmWasm and Cosmos SDK audit can catch consensus-critical issues such as non-determinism, incorrect signers, and ABCI panics. It identifies platform-specific vulnerabilities across nine patterns that could cause chain halts, fund loss, or governance issues.