solana-vulnerability-scannerskills.sh · trailofbits

5,664 installs

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

Generates or handles private keys

Hosts contacted: www.anchor-lang.comsolanacookbook.com

Evidence lines

generates_or_handles_keys — SKILL.md: const fakeTokenProgram = anchor.web3.Keypair.generate();

Our disclosure is a static description of what the skill declares and does; it is not a safety verdict. Source record: www.skills.sh/trailofbits/skills/solana-vulnerability-scanner. Targets trailofbits-skills.

Sato Check

as of 2026-10-26

Does it take your key?: Unknown
Does your key leave?: Not yet run
Can it move funds on its own?: Unknown

Full profile, evidence and limits →

A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

Install

npx skills add trailofbits/skills@solana-vulnerability-scanner

Copied from the registry's documented install form. Read the disclosure above first; it is the whole point of this page.

Observed record

8 weekly observations since 2026-09-07. Installs 4873 → 5664.

The skill's content hash has not changed while we watched.

Cite this page

Sato Hub. "solana-vulnerability-scanner — skill disclosure on Sato Hub." Sato Hub, updated 2026-10-29, accessed 2026-10-29. https://satohub.ai/skills/skillssh%3Atrailofbits%2Fskills%2Fsolana-vulnerability-scanner

Data last refreshed 2026-10-29; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0.