Can I integrate this into my CI/CD pipeline?

Yes, the skill provides recommendations for integrating Caracal and other security checks into GitHub Actions or other CI workflows for continuous security monitoring.

Which specific vulnerabilities does this scanner detect?

The scanner focuses on 6 critical patterns: unchecked felt252 arithmetic, storage collisions, missing access controls, improper felt252 boundaries, unvalidated contract addresses, and missing caller validation in L1 handlers.

How does it assist with L1-L2 bridge security?

It audits #[l1_handler] functions to ensure the from_address is correctly validated against authorized L1 bridges, preventing unauthorized message execution.

Does this skill work with Cairo 1.0 projects?

Yes, it is specifically designed for modern Cairo 1.0+ syntax, including attribute-based contracts, and looks for project markers like Scarb.toml.

Cairo/StarkNet Security Scanner

Name: Cairo/StarkNet Security Scanner
Author: monmacllcapp

bymonmacllcapp

0•

Security & Testing

Scans Cairo smart contracts for critical vulnerabilities including arithmetic overflows, L1-L2 messaging flaws, and signature replay attacks.

The Cairo Vulnerability Scanner is a specialized security tool designed for auditing StarkNet smart contracts written in the Cairo language. It systematically identifies six critical vulnerability patterns unique to the StarkNet ecosystem, such as felt252 arithmetic errors, improper cross-layer message handling, and address conversion issues. By providing automated detection, integration with tools like Caracal, and detailed remediation guidance, this skill empowers developers to conduct pre-launch security assessments and secure complex L1-L2 bridge implementations.

Key Features

01Analyzes L1-L2 messaging and cross-layer bridge security

02Identifies felt252 arithmetic overflows and underflows

030 GitHub stars

04Detects 6 critical Cairo-specific vulnerability patterns

05Provides detailed finding reports with actionable code fixes

06Integrates with Caracal static analyzer for automated scans

Use Cases

01Validating signature verification logic to prevent replay attacks

02Auditing StarkNet smart contracts before mainnet deployment

03Securing L1-L2 bridge implementations and message handlers

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks cairo-vulnerability-scanner

For use in Claude.ai and ChatGPT

Download Skill