solana-vulnerability-scanner — Skills

Requirements & configuration

1. Attacker deploys malicious "token program" that logs transfer instruction but doesn't execute it

Use Anchor's Program<'info, Token> type:

use anchorspl::token::{Token, Transfer};

pub tokenprogram: Program<'info, Token>, // Validates program ID automatically

anchorspl::token::transfer(cpictx, amount)?;

solana vulnerability scanner

Source

Repository: https://github.com/trailofbits/skills

solana-vulnerability-scanner FAQ

What does the solana-vulnerability-scanner skill do?

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. Auditing Solana programs (native Rust or Anchor) Reviewing cross-program invocation (CPI) logic

What does solana-vulnerability-scanner require?

1. Attacker deploys malicious "token program" that logs transfer instruction but doesn't execute it Use Anchor's Program<'info, Token> type: use anchorspl::token::{Token, Transfer}; pub tokenprogram: Program<'info, Token>, // Validates program ID automatically anchorspl::token::transfer(cpictx, amount)?;

How do I install solana-vulnerability-scanner?

Run: npx -y skills add https://github.com/trailofbits/skills --skill solana-vulnerability-scanner --agent claude-code — the source lives at github.com/trailofbits/skills.

Maintain solana-vulnerability-scanner?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[solana-vulnerability-scanner on getagentictools](https://getagentictools.com/skills/trailofbits-skills-solana-vulnerability-scanner?ref=badge)

npx agentictools info skills/trailofbits-skills-solana-vulnerability-scanner

The second line is the CLI lookup for this page — handy in READMEs and docs.