cosmos-vulnerability-scanner
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Cosmos Vulnerability Scanner ## Purpose Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents — each specializing in a vulnerability category — that return findings to the main skill, which then writes them as individual markdown files to an output directory. **Output directory**: defaults to `.bughunt_cosmos/`. If the user specifies a different directory in their prompt, use that instead. ## When to Use - Auditing Cosmos SDK modules (custom `x/` modules) - Reviewing CosmWasm smart contracts - Pre-launch security assessment of Cosmos chains - Investigating chain halt incidents ## When NOT to Use - Pure Solidity/EVM audits without Cosmos SDK — use Solidity-specific tools - CometBFT consensus engine internals — this covers SDK modules, not the consensus layer itself - General Go code review with no blockchain context - Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints) - CosmWasm contract-only audits on chains without custom SDK modules — use the CosmWasm checklist items alone ## Essential Principles 1. **Consensus path is king** — A b
- Purpose
- When to Use
- When NOT to Use
- Essential Principles
- Scanning Workflow
- Phase 1: Discovery (synchronous)
- Phase 2: Parallel Vulnerability Scan
- Phase 3: Write Findings
- Phase 4: Verify Completeness
- Success Criteria
- Resources
What does the cosmos-vulnerability-scanner skill do?
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
How do I install it?
Run `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.