solana-vulnerability-scanner

仓库创建 2026年1月15日最近提交 7 天前SkillHot 收录 20 天前

▸ 精选理由

将 Solana 特有的 CPI、PDA、签名/所有权校验等模式编码为自动检测规则

▸ 风险提示

需本地或远程构建/运行分析工具并访问链上数据，可能执行外部二进制

这个 Skill 做什么

针对 Solana/Anchor 程序检测 6 类关键平台特有漏洞

能自动扫描 Solana/Anchor 程序，找出六类平台特有的关键漏洞，比如任意 CPI、PDA 验证不严、缺少 signer/ownership 校验和 sysvar 欺骗等。适合在代码审计或发布前对本地或 Anchor 程序做安全检查，节省人工检阅低级错误的时间。特点是把 Solana 账户模型的六种脆弱模式编码成规则，能同时处理原生和 Anchor 框架代码，快速定位高风险点。

▸ 展开 SKILL.md 英文原文

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

垂直行业Solana漏洞扫描CPI/PDA校验审计工具通用

6.3k

Stars

542

Forks

仓库内 Skill

+270

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Solana Vulnerability Scanner

## 1. Purpose

Systematically scan Solana programs (native and Anchor framework) for platform-specific security vulnerabilities related to cross-program invocations, account validation, and program-derived addresses. This skill encodes 6 critical vulnerability patterns unique to Solana's account model.

## 2. When to Use This Skill

- Auditing Solana programs (native Rust or Anchor)
- Reviewing cross-program invocation (CPI) logic
- Validating program-derived address (PDA) implementations
- Pre-launch security assessment of Solana protocols
- Reviewing account validation patterns
- Assessing instruction introspection logic

## 3. Platform Detection

### File E

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有