SECURITY REVIEW / Trail of Bits
Solana vulnerability scanner
Pins Trail of Bits' Solana scanner, which refuses a short coverage table, keeps the version-scoped row, and does not treat passing lints or an Anchor attribute as a full check.
“Requires a verdict on every listed Solana pattern, says passing lints are not a full scan, and keeps the version-scoped row.”
01 / THE REASONING
Why this made the selection.
- A short or empty coverage table is an incomplete scan, and the version-scoped pattern stays in the table with the targeted solana-program version instead of being dropped.
- Passing lints do not cover patterns they never examined, a mutable account attribute is not an ownership check, and address derivation is not validation.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md
- plugins/building-secure-contracts/README.md
- README.md
- LICENSE
Our findings
- The skill requires one coverage row for every pattern in its own list. A shorter table, or an empty verdict, is an incomplete scan.
- Not-applicable needs a reason. Not having looked does not qualify, and a zero-finding scan still emits the full table.
- The version-scoped pattern is kept by citing the solana-program version the program targets, rather than dropping the row.
- A clean lint run is evidence only for patterns the lints examined.
- The skill says a mutable account attribute is not an ownership check and that derivation is not the same as validation.
Not established by this review
- The resource was not executed, and no Solana lint or local validator was run.
- resources/VULNERABILITY_PATTERNS.md was not opened.
- No program was scanned and no suggested fix was applied.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin install trailofbits/skills/plugins/building-secure-contractsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The plugin README shows the command above. It installs the building-secure-contracts plugin, which contains this skill and the plugin's other skills. It does not install this file alone.
- The repository README shows `/plugin marketplace add trailofbits/skills`, which adds the marketplace and not this skill, then `/plugin menu` to browse plugins.
- The Codex section uses `codex plugin marketplace add trailofbits/skills` and a placeholder plugin name. The placeholder was not used as the command.
Before you start
- Claude Code or Codex marketplace support
- A native or Anchor Solana program if the skill is used as written
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md
Supports: incomplete-table refusal, version-scoped row, and lint and Anchor limits
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md
Supports: plugin install line for the whole building-secure-contracts plugin
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: marketplace install line and CC-BY-SA-4.0 statement
- Repository LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Creative Commons Attribution-ShareAlike 4.0 International