Star200+

Skill audit report

cosmos-vulnerability-scanner Audit report.

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

BLOCKED · BLOCKNeeds reviewGenerated Aug 24, 2026Heuristic metadata audit
81
Audit
71
Trust
85
Quality
72
Security
100
Maintain
92
Install

OpenAgentSkill Trust Score

71
Manual review

OpenAgentSkill Trust Score

The Trust Score helps an agent decide whether a skill is safe enough to shortlist before installation.

GitHub adoption

PASS

94

6.8K GitHub stars

Stars/forks activity

PASS

88

6.8K stars, 585 forks; issue activity unavailable in current metadata

Recent maintenance

PASS

100

Pushed today

License clarity

PASS

86

CC-BY-SA-4.0

README/SKILL.md completeness

INFO

76

Public metadata needs stronger README/SKILL.md context

Dependency/runtime risk

WARN

54

command execution surface, credential or environment access

Install availability

PASS

92

npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner

Install command safety

PASS

92

standard package or runtime install path

Permission surface

FAIL

22

secrets or environment access, shell or command execution

Repository evidence

PASS

86

https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner

Review status

INFO

66

AI review data available

Agent Proven outcomes

INFO

54

No agent outcome data yet

Checks

Install and adoption review

8 Passed · 14 Needs review

Install path

92

PASS

npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner

Repository

88

PASS

https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner

License

86

PASS

CC-BY-SA-4.0

Maintenance

100

PASS

Pushed today

AI review

55

CHECK

Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.

README/SKILL.md completeness

84

PASS

Usable description available

Dependency risk

54

FIX

command execution surface, credential or environment access

Install command safety

92

PASS

standard package or runtime install path

Permission surface

22

FIX

secrets or environment access, shell or command execution

Stars/forks activity

88

PASS

6.8K stars, 585 forks; issue activity unavailable in current metadata

Adoption

88

PASS

6.8K GitHub stars

Financial decision safety

58

CHECK

Research-only use: do not treat output as financial advice or execute a position without human approval.

Warnings

  • Dependency or permission surface needs review
  • Permission surface may require sandboxing
  • Financial research output is not financial advice; require human review before any live investment decision
  • Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.
  • The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.
  • Financial research output is not financial advice; require human review before any live investment decision.
  • Quality score needs review
  • Permission surface needs review: secrets or environment access, shell or command execution
  • Dependency/runtime risk: command execution surface, credential or environment access
  • Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.

Compare nearby options

Related skills to audit next

Wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

16K Stars · Audit report

Maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

33K Stars · Audit report

Nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

29K Stars · Audit report