Cairo Vulnerability Scanner
The Cairo Vulnerability Scanner analyzes Cairo smart contracts for potential security flaws, aiding developers in building robust and secure decentralized applications.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add cairo-vulnerability-scanner npx -- -y @trustedskills/cairo-vulnerability-scanner
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"cairo-vulnerability-scanner": {
"command": "npx",
"args": [
"-y",
"@trustedskills/cairo-vulnerability-scanner"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
The Cairo Vulnerability Scanner skill analyzes Cairo smart contract code for potential security vulnerabilities. It helps identify common issues such as arithmetic overflows, reentrancy risks, and incorrect access controls within Starknet programs written in Cairo. This tool aims to improve the overall security posture of Cairo-based applications by proactively detecting and mitigating weaknesses.
When to use it
- Smart contract development: Integrate into your CI/CD pipeline to automatically scan new or modified Cairo contracts before deployment.
- Security audits: Use as part of a broader security audit process to identify potential vulnerabilities beyond manual code review.
- Vulnerability research: Analyze existing Cairo smart contracts to discover and understand common attack patterns.
- Educational purposes: Learn about common Cairo vulnerability types by examining real-world examples.
Key capabilities
- Static analysis of Cairo code
- Identification of potential security vulnerabilities
- Supports Starknet programs written in Cairo
Example prompts
- "Scan this Cairo smart contract for vulnerabilities: [paste contract code]"
- "Analyze the following Starknet program and report any potential security risks: [paste program code]"
- "Find arithmetic overflow issues in this Cairo contract."
Tips & gotchas
- The scanner's effectiveness depends on the quality of its vulnerability signatures. It may not detect all possible vulnerabilities.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.