cairo-vulnerability-scanner
by trailofbitscairo-vulnerability-scanner scans Cairo/StarkNet smart contracts for six critical issues, including felt252 arithmetic errors, L1-L2 messaging flaws, address conversion bugs, and signature replay. Use this cairo-vulnerability-scanner skill for Security Audit reviews of StarkNet contracts.
This skill scores 78/100, which means it is a solid listing candidate for directory users who need a Cairo/StarkNet-specific audit workflow. The repository provides enough concrete vulnerability patterns and usage cues to help an agent trigger and apply it with less guesswork than a generic security prompt, though it would still benefit from stronger onboarding and execution guidance.
- Explicit use cases for auditing StarkNet/Cairo contracts, L1-L2 bridges, signature verification, and L1 handlers make it easy to trigger appropriately.
- The body is substantial and structured, with 6 named vulnerability patterns and checklist-style detection guidance that gives agents actionable leverage.
- Repository evidence includes code fences, repo/file references, and a dedicated resources file of vulnerability patterns, which improves operational clarity and trustworthiness.
- No install command or setup instructions are present, so directory users must infer how to activate or integrate the skill.
- Support material is limited to one resource file and no scripts/tests, so the workflow may be less complete for edge cases or automation-heavy use.
Overview of cairo-vulnerability-scanner skill
What cairo-vulnerability-scanner does
The cairo-vulnerability-scanner skill helps you review Cairo/StarkNet contracts for platform-specific security issues that are easy to miss in a generic Solidity-style audit. It focuses on six critical patterns, including felt252 arithmetic mistakes, L1-L2 messaging risks, address conversion problems, and signature replay.
Who should use it
Use the cairo-vulnerability-scanner skill if you are doing a Security Audit for StarkNet apps, bridge code, or Cairo contract logic. It is most useful when you already have contract files and want a targeted first-pass vulnerability review before deeper manual analysis.
What makes it different
The value is not just “scan for bugs,” but “scan for Cairo-specific bugs.” That matters because many failures in this ecosystem come from type choices, cross-layer assumptions, and handler logic rather than obvious reentrancy or generic access-control issues. The skill is strongest when you want a fast, structured checklist for known Cairo risk patterns.
How to Use cairo-vulnerability-scanner skill
Install and point it at the right scope
Use the cairo-vulnerability-scanner install flow in the Trail of Bits skills package, then apply it to the repository or contract subset you actually want reviewed. The primary input should be Cairo source, especially .cairo files, plus any bridge, handler, or signature-verification modules tied to StarkNet behavior.
Give it a security-review prompt, not a vague task
A strong prompt names the contract area, the trust boundaries, and the concern. For example: “Audit this Cairo StarkNet module for L1 handler misuse, felt252 arithmetic issues, and signature replay risk. Focus on externally reachable functions and message validation.” That works better than “check for vulnerabilities” because it steers the scan toward the six intended patterns.
Read these files first
Start with SKILL.md for the intended workflow, then inspect resources/VULNERABILITY_PATTERNS.md for the concrete detection logic and mitigation notes. If the repository has only one support file, that is the one to read before you run the skill on real code.
Use a narrow workflow
Begin with the contract entry points: external functions, constructors, and #[l1_handler] functions. Then review arithmetic on balances, conversions between felt252, ContractAddress, and EthAddress, and any logic that accepts messages or signatures from outside the contract. This order matches how cairo-vulnerability-scanner is designed to find high-value issues quickly.
cairo-vulnerability-scanner skill FAQ
Is this for all smart contracts?
No. The cairo-vulnerability-scanner skill is for Cairo and StarkNet contracts, not generic EVM audits. If your codebase is mostly Solidity or Rust off-chain services, the skill will add little value.
Do I need to know Cairo well first?
Basic familiarity helps, but the skill is still useful for beginners who need a guided Security Audit starting point. It is especially helpful when you know the application flow but need help checking Cairo-specific failure modes.
How is this different from a normal prompt?
A normal prompt often finds surface-level issues. The cairo-vulnerability-scanner skill gives you a repeatable review frame for known StarkNet weaknesses, which reduces missed cases and makes the audit output easier to compare across contracts.
When should I not use it?
Do not use it as your only review method for a production launch, and do not use it when the repository has no Cairo contracts. It is a focused scanner, not a full formal verification or threat-modeling replacement.
How to Improve cairo-vulnerability-scanner skill
Provide the contract context that changes the audit
The best inputs name the contract role, the asset at risk, and the cross-layer path. For example: “This bridge deposit contract receives L1 messages and mints on StarkNet; check for replay, address conversion, and handler validation.” That is far stronger than listing files alone because it tells the skill which vulnerability patterns matter most.
Mention the exact data types and trust assumptions
Results improve when you include the types and invariants that drive Cairo bugs: felt252 math, balance storage, u256 conversion, ContractAddress handling, and any signature scheme. If the contract expects monotonic nonces, message uniqueness, or bounded amounts, say so explicitly.
Iterate on the first findings
If the first pass returns suspicious arithmetic or message handling, ask for a second pass that drills into only those locations and requests exploit paths, not just observations. For example: “Review these two functions for replay or underflow exploitability and suggest the minimal fix.” That usually produces more actionable cairo-vulnerability-scanner usage results than rerunning the full scan unchanged.
Feed it the right repo slice
You will get better output by isolating the relevant .cairo files than by sending an entire monorepo with mixed languages. For cairo-vulnerability-scanner for Security Audit, the highest-signal inputs are contract files, handler modules, and any helper code that transforms addresses, signatures, or cross-layer payloads.