Menu

Individual skill

chain-vulnerability-scanner

Use when an Algorand, Cairo, Cosmos SDK, Solana, Substrate, or TON codebase needs vulnerability scanning with reachability-backed findings. Not for non-chain review: use security-review.

.devin/skills/chain-vulnerability-scanner/SKILL.md

Read pinned source

Source commit b0e8ce89a19fac880251dc3ea1babfeb4503a4fe

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
55
Repository last updated
Sep 28, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Chain vulnerability scanner

A single read-only scan operation that classifies a blockchain codebase by ecosystem, loads only that ecosystem's detector catalog, and emits severity-ranked findings tied to reachable code paths. Six ecosystems are supported; each owns one flat reference file under `references/` that holds its detectors, applicability gates, tool requirements, severity distinctions, and ecosystem caveats. This file holds the shared routing, authority, procedure, cross-cutting rules, failure behavior, and output contract.

## Ecosystem routing

| Ecosystem | Source indicators | Reference file |
|---|---|---|
| Algorand | `.teal` files; `.py` importing PyTeal or Algorand SDK (`from pyteal import *`, `from algosdk import *`, `Txn`, `Gtxn`, `Global`, `InnerTxnBuilder`, `OnComplete`, `@router.method`, `@Subroutine`); `approval_program.py`/`clear_program.py`, `contract.teal`/`signature.teal`, Beaker references. | `references/algorand.md` |
| Cairo / Starknet | `.cairo` files; `Scarb.toml`; contract markers `#[contract]`, `#[storage]`, `#[external(v0)]`, `#[l1_handler]`, `#[constructor]`, `felt252`, `ContractAddress`, `get_caller_address()`, `send_message_to_l1_syscall`. Optional L1 bridge Solidity contracts for cross-layer patterns. | `references/cairo.md` |
| Cosmos SDK | Go source with Cosmos SDK `x/` modules and `go.mod`; `ibc-go`; Ethermint/EVM precompiles (`evmutil`/`feemarket`); Rust contracts using `cosmwasm_std`. | `references/cosmos-sdk.md` |
| Solana | Solana or Anchor Rust (`.rs`) program files. | `references/solana.md` |
| Substrate | Substrate FRAME pallet Rust source tree or file within a runtime. | `references/substrate.md` |
| TON | FunC or Tact source (function definitions, message handlers, `recv_internal`, `recv_external`, `op::` constants, `@interface` annotations). | `references/ton.md` |