Cosmos Vulnerability Scanner
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical...
Install
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Security
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 2,624 tokens
- Runs scripts
- No, instructions only
What it does
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities, chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
Cosmos Vulnerability Scanner
Purpose
Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents, each specializing in a vulnerability category, that return findings to the main skill, which then writes them as individual markdown files to an output directory.
Output directory: defaults to .bughunt_cosmos/. If the user specifies a different directory in their prompt, use that instead.
When to Use
- Auditing Cosmos SDK modules (custom
x/modules) - Reviewing CosmWasm smart contracts
- Pre-launch security assessment of Cosmos chains
- Investigating chain halt incidents
When NOT to Use
- Pure Solidity/EVM audits without Cosmos SDK, use Solidity-specific tools
- CometBFT consensus engine internals, this covers SDK modules, not the consensus layer itself
- General Go code review with no blockchain context
- Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints)
- CosmWasm contract-only audits on chains without custom SDK modules, use the CosmWasm checklist items alone
