Overview
cosmos-vulnerability-scanner is an open-source security skill for Claude Code and compatible agents, published by trailofbits. Its author describes it as: “Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x…”. The project has 6.6k stars on GitHub and is available under the CC-BY-SA-4.0 license. Add it to your setup with `/plugin marketplace add trailofbits/skills`.
What cosmos-vulnerability-scanner does
Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents — each specializing in a vulnerability category — that return findings to the main skill, which then writes them as individual markdown files to an output directory.
What’s inside
The SKILL.md for cosmos-vulnerability-scanner is organised into these sections:
- Purpose
- When to Use
- When NOT to Use
- Essential Principles
- Scanning Workflow
- Phase 1: Discovery (synchronous)
- Phase 2: Parallel Vulnerability Scan
- [SEVERITY] Title
- Phase 3: Write Findings
- Phase 4: Verify Completeness
- Success Criteria
- Resources
Installation
Add cosmos-vulnerability-scanner to your agent with:
/plugin marketplace add trailofbits/skillsReview a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.
Supported agents
- Claude Code — ships a claude code plugin marketplace
License
cosmos-vulnerability-scanner is published under the CC-BY-SA-4.0 license.
Strengths
- Clear CC-BY-SA-4.0 license — safe to read and adapt within its terms
- Ships in trailofbits/skills, an established project with 6,646 GitHub stars
- Works with Claude Code
- Actively maintained — repository updated in the last 90 days
Author
Topics
Frequently asked questions
- What does cosmos-vulnerability-scanner do?
- Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
- How do I install cosmos-vulnerability-scanner?
- Run /plugin marketplace add trailofbits/skills in your agent, then reload your skills. Review the source at https://github.com/trailofbits/skills before installing.
- Is cosmos-vulnerability-scanner free to use?
- Yes. cosmos-vulnerability-scanner is free and open source under the CC-BY-SA-4.0 license, so you can read, run, and adapt it within that license's terms.
- Which agents does cosmos-vulnerability-scanner work with?
- cosmos-vulnerability-scanner lists Claude Code — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
- Where does cosmos-vulnerability-scanner come from?
- cosmos-vulnerability-scanner ships inside trailofbits/skills, a repository that contains 41 catalogued skills in total. The repository's 6,646 GitHub stars apply to that whole collection, not to this skill on its own.