# Cosmos Vulnerability Scanner

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities, chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cosmos Vulnerability Scanner

## Purpose

Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents, each specializing in a vulnerability category, that return findings to the main skill, which then writes them as individual markdown files to an output directory.

**Output directory**: defaults to `.bughunt_cosmos/`. If the user specifies a different directory in their prompt, use that instead.

## When to Use

- Auditing Cosmos SDK modules (custom `x/` modules)
- Reviewing CosmWasm smart contracts
- Pre-launch security assessment of Cosmos chains
- Investigating chain halt incidents

## When NOT to Use

- Pure Solidity/EVM audits without Cosmos SDK, use Solidity-specific tools
- CometBFT consensus engine internals, this covers SDK modules, not the consensus layer itself
- General Go code review with no blockchain context
- Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints)
- CosmWasm contract-only audits on chains without custom SDK modules, use the CosmWasm checklist items alone

## Essential Principles

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner/SKILL.md