Cairo Vulnerability Scanner
Scans Cairo/StarkNet contracts for felt252 overflow and messaging vulnerabilities.
Test report
- Verdict
- Works with setup
- Score
- Tested
- Jul 12, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 3348bc8
Verbatim install is clean and the tightly-scoped Cairo/StarkNet description triggers accurately, but the docs have a real defect: SKILL.md's own '6 pattern' summary (Storage Collision, Improper Felt252 Boundaries, Missing Caller Validation, etc.) does not match the 6 patterns actually documented in resources/VULNERABILITY_PATTERNS.md (Felt252 Arithmetic, L1-L2 Address Conversion, L1-L2 Message Failure, Overconstrained L1<->L2, Signature Replay, Unchecked L1 Handler), and the file carries a duplicated '## 5.' header -- a copy-paste artifact from a sibling scanner skill. On an A/B against a 5-issue deliberately-vulnerable contract, the skill caught all 5 with no false positives, but the base arm (no skill) independently caught the same 5 plus the felt252-vs-u256 design note, so the skill showed no catch-rate lift on this contract. The value it adds is a structured, StarkNet-specific checklist and remediation references rather than additional detections.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 5/10
- Docs & honesty 2/5
What Cairo Vulnerability Scanner does
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
How to install Cairo Vulnerability Scanner
git clone https://github.com/trailofbits/skills
cd skills
mkdir -p ~/.claude/skills
cp -r plugins/building-secure-contracts/skills/cairo-vulnerability-scanner ~/.claude/skills/cairo-vulnerability-scanner
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Cairo Vulnerability Scanner
-
/cairo-vulnerability-scannerScans Cairo/StarkNet contracts for felt252 overflow and messaging vulnerabilities.
It also activates on plain-language prompts like these:
-
Scan this Cairo contract for vulnerabilities -
Audit our StarkNet contract for signature replay bugs -
Check for L1-L2 messaging issues in this contract
Frequently asked questions
- Is the Cairo Vulnerability Scanner skill free?
- Yes. The skill itself is free from trailofbits/skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Cairo Vulnerability Scanner work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 12, 2026. Verdict: Works with setup. Verbatim install is clean and the tightly-scoped Cairo/StarkNet description triggers accurately, but the docs have a real defect: SKILL.md's own '6 pattern' summary (Storage Collision, Improper Felt252 Boundaries, Missing Caller Validation, etc.) does not match the 6 patterns actually documented in resources/VULNERABILITY_PATTERNS.md (Felt252 Arithmetic, L1-L2 Address Conversion, L1-L2 Message Failure, Overconstrained L1<->L2, Signature Replay, Unchecked L1 Handler), and the file carries a duplicated '## 5.' header -- a copy-paste artifact from a sibling scanner skill. On an A/B against a 5-issue deliberately-vulnerable contract, the skill caught all 5 with no false positives, but the base arm (no skill) independently caught the same 5 plus the felt252-vs-u256 design note, so the skill showed no catch-rate lift on this contract. The value it adds is a structured, StarkNet-specific checklist and remediation references rather than additional detections.
- What is the Cairo Vulnerability Scanner SkillProof Score?
- 6.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 5/10, docs & honesty 2/5.
- How do I install Cairo Vulnerability Scanner?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Cairo Vulnerability Scanner with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.