--- title: "Solana vulnerability scanner: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-solana-vulnerability-scanner/ description: "Pins Trail of Bits' Solana scanner, which refuses a short coverage table, keeps the version-scoped row, and does not treat passing lints or an Anchor attribute as a full check." --- # Solana vulnerability scanner: review, setup & limitations · Undominated.ai > Pins Trail of Bits' Solana scanner, which refuses a short coverage table, keeps the version-scoped row, and does not treat passing lints or an Anchor attribute as a full check. [← Explore all skills](/skills/) SECURITY REVIEW / Trail of Bits # Solana vulnerability scanner Pins Trail of Bits' Solana scanner, which refuses a short coverage table, keeps the version-scoped row, and does not treat passing lints or an Anchor attribute as a full check. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/solana-vulnerability-scanner) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Requires a verdict on every listed Solana pattern, says passing lints are not a full scan, and keeps the version-scoped row.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - A short or empty coverage table is an incomplete scan, and the version-scoped pattern stays in the table with the targeted solana-program version instead of being dropped. - Passing lints do not cover patterns they never examined, a mutable account attribute is not an ownership check, and address derivation is not validation. ### A good fit for - Reviewing a native or Anchor Solana program when every pattern in this skill's own list needs a found, clear, or reasoned not-applicable verdict ### Weigh up before choosing - This review did not execute the resource. - `/plugin install trailofbits/skills/plugins/building-secure-contracts` installs the building-secure-contracts plugin, not this skill alone. - `/plugin marketplace add trailofbits/skills` adds the Trail of Bits marketplace, not this skill. - resources/VULNERABILITY_PATTERNS.md was not opened. The finding template contains an attack narrative. This review did not reproduce it. - An example dependency line pins solana-program 1.17 and comments that the latest version should be used. This review does not treat 1.17 as a current requirement. - The skill says it will provide fixes. It does not separate a dry-run from an edit, and no edit was made. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md - plugins/building-secure-contracts/README.md - README.md - LICENSE ### Our findings - The skill requires one coverage row for every pattern in its own list. A shorter table, or an empty verdict, is an incomplete scan. - Not-applicable needs a reason. Not having looked does not qualify, and a zero-finding scan still emits the full table. - The version-scoped pattern is kept by citing the solana-program version the program targets, rather than dropping the row. - A clean lint run is evidence only for patterns the lints examined. - The skill says a mutable account attribute is not an ownership check and that derivation is not the same as validation. ### Not established by this review - The resource was not executed, and no Solana lint or local validator was run. - resources/VULNERABILITY_PATTERNS.md was not opened. - No program was scanned and no suggested fix was applied. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md) DOCUMENTED COMMAND /plugin install trailofbits/skills/plugins/building-secure-contracts Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The plugin README shows the command above. It installs the building-secure-contracts plugin, which contains this skill and the plugin's other skills. It does not install this file alone. - The repository README shows `/plugin marketplace add trailofbits/skills`, which adds the marketplace and not this skill, then `/plugin menu` to browse plugins. - The Codex section uses `codex plugin marketplace add trailofbits/skills` and a placeholder plugin name. The placeholder was not used as the command. ### Before you start - Claude Code or Codex marketplace support - A native or Anchor Solana program if the skill is used as written ### Compatibility Claude Code · Codex ### Implementation Rust ### Local review skill; it reads program text and does not itself submit a transaction - Read the skill text - Read Rust or Anchor source the operator points at - Run a linter or local validator only if the operator chooses to - Does not authorize submitting a transaction or applying a fix ### Cost model CC-BY-SA-4.0; the skill was not run 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [solana-vulnerability-scanner SKILL.md ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md Supports: incomplete-table refusal, version-scoped row, and lint and Anchor limits - [building-secure-contracts plugin README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md Supports: plugin install line for the whole building-secure-contracts plugin - [Repository README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: marketplace install line and CC-BY-SA-4.0 statement - [Repository LICENSE ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: Creative Commons Attribution-ShareAlike 4.0 International KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/)[### CodeQL ↗ Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files.](/skills/trailofbits-codeql/)[### Entry-point analyzer ↗ Lists state-changing smart-contract entry points and their access class, and excludes view functions, exploit writing, and non-contract code.](/skills/trailofbits-entry-point-analyzer/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)