Skip to main content Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/praxstack/ai-visual-code-review --skill cairo-vulnerability-scannerDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... Mehr aus diesem Repository
Principal-engineer-grade autonomous execution mode for any AI coding agent. Calibrates rigor to task size: one primitive cycle for tiny work, 3-phase contract for small, 10-phase for medium/large. Loops until verified. Keep-or-revert on every change. Writes Actionable Side Information on failures. Escalates through a 6-tier Fallback Matrix. Respects 6 Ambiguity Blockers as the only valid pause reasons. Emits binary acceptance criteria per phase and a structured Final Summary at completion. Use on explicit opt-in via the APEX-ON token, /apex or /autonomous slash commands, auto-task wrapper, or the phrase apply APEX after echo-confirmation. Trigger keywords: APEX, autonomous mode, principal engineer mode, rigorous execution, godel primitives, keep-or-revert, loop-until-verified, ambiguity blocker, fallback matrix, ASI, auto-task, apex-on, /apex, /autonomous. Not for conversational exploration or trivial edits.
Host-neutral autonomous software work protocol. Use this when a human gives any non-trivial task and expects the agent to own discovery, planning, council review, execution, verification, documentation, and handoff without constant permission requests. Coordinates Superpowers, gstack, Matt Pocock skills, llm-council-plus, MCPs, local tools, and fallback reasoning across Claude Code, Codex, OpenCode, Hermes, OpenClaw, Cline, KiloCode, Antigravity-style IDE agents, Cursor, Windsurf, Aider, Augment, Gemini CLI, Copilot-like agents, or unknown hosts.
backend-architecture-standards Principal-engineer standards for backend services, APIs, data modeling, distributed systems, and reliability. Use when building or reviewing REST/GraphQL/gRPC APIs, database schemas, service boundaries, caching strategies, messaging, observability, or scaling patterns. Triggers on "design an API", "database schema", "service architecture", "distributed system", "caching strategy", "rate limit", "reliability pattern", "migration plan", "message queue", "SLI/SLO", and backend production reviews. Covers API disciplines, data modeling, scaling patterns, reliability patterns, DevOps and infra, data storage, observability, and performance. Loaded by super-mode-core for backend-heavy work.
name cairo-vulnerability-scanner description Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
Cairo/StarkNet Vulnerability Scanner
1. Purpose
Systematically scan Cairo smart contracts on StarkNet for platform-specific security vulnerabilities related to arithmetic, cross-layer messaging, and cryptographic operations. This skill encodes 6 critical vulnerability patterns unique to Cairo/StarkNet ecosystem.
2. When to Use This Skill
Auditing StarkNet smart contracts (Cairo)
Reviewing L1-L2 bridge implementations
Pre-launch security assessment of StarkNet applications
Validating cross-layer message handling
Reviewing signature verification logic
Assessing L1 handler functions
3. Platform Detection
File Extensions & Indicators
Language/Framework Markers
#[contract]
mod MyContract {
use starknet::ContractAddress;
#[storage]
struct Storage {
balance: LegacyMap<ContractAddress, felt252>,
}
#[external(v0)]
fn transfer (ref self : ContractState, to: ContractAddress, amount: felt252) {
}
#[l1_handler]
fn
handle_deposit
ref
self
u128
#[external(v0)]
#[l1_handler]
#[constructor]
get_caller_address
get_contract_address
Project Structure
src/contract.cairo - Main contract implementationsrc/lib.cairo - Library modulestests/ - Contract testsScarb.toml - Cairo project configuration
Tool Support
Caracal : Trail of Bits static analyzer for CairoInstallation: cargo install --git https://github.com/crytic/caracal --profile release --force (a Rust tool — not on PyPI)
Usage: caracal detect src/
cairo-test : Built-in testing frameworkStarknet Foundry : Testing and development toolkit
4. How This Skill Works
Search your codebase for Cairo filesAnalyze each contract for the 6 vulnerability patternsReport findings with file references and severityProvide fixes for each identified issueCheck L1-L2 interactions for messaging vulnerabilities
5. Example Output When vulnerabilities are found, you'll get a report like this:
=== CAIRO/STARKNET VULNERABILITY SCAN RESULTS ===
6. Vulnerability Patterns (6 Patterns) I check for 6 critical vulnerability patterns unique to Cairo/Starknet. For detailed detection patterns, code examples, mitigations, and testing strategies, see VULNERABILITY_PATTERNS.md .
Pattern Summary:
Unchecked Arithmetic ⚠️ CRITICAL - Integer overflow/underflow in felt252Storage Collision ⚠️ CRITICAL - Conflicting storage variable hashesMissing Access Control ⚠️ CRITICAL - No caller validation on sensitive functionsImproper Felt252 Boundaries ⚠️ HIGH - Not validating felt252 rangeUnvalidated Contract Address ⚠️ HIGH - Using untrusted contract addressesMissing Caller Validation ⚠️ CRITICAL - No get_caller_address() checks
7. Scanning Workflow
Step 1: Platform Identification
Verify Cairo language and StarkNet framework
Check Cairo version (Cairo 1.0+ vs legacy Cairo 0)
Locate contract files (src/*.cairo)
Identify L1-L2 bridge contracts (if applicable)
Step 2: Arithmetic Safety Sweep
rg "felt252" src/ | rg "[-+*/]"
rg "felt252" src/ | rg "balance|amount|total|supply"
Step 3: L1 Handler Analysis For each #[l1_handler] function:
Step 4: Signature Verification Review For signature-based functions:
Step 5: L1-L2 Bridge Audit If contract includes bridge functionality:
Step 6: Static Analysis with Caracal
caracal detect src/
caracal detect src/ --detectors unchecked-felt252-arithmetic
caracal detect src/ --detectors unchecked-l1-handler-from
caracal detect src/ --detectors missing-nonce-validation
8. Reporting Format
Finding Template ## [CRITICAL] Unchecked from_address in L1 Handler
**Location** : `src/bridge.cairo:145-155` (handle_ deposit function)
**Description** :
The `handle_deposit` L1 handler function does not validate the `from_address` parameter. Any L1 contract can send messages to this function and mint tokens for arbitrary users, bypassing the intended L1 bridge access controls.
**Vulnerable Code** :
```rust
// bridge.cairo, line 145
#[l1_handler]
fn handle_deposit(
ref self: ContractState,
from_address: felt252, // Not validated!
user: ContractAddress,
amount: u256
) {
let current_balance = self.balances.read(user);
self.balances.write(user, current_balance + amount);
}
```
**Attack Scenario** :
1. Attacker deploys malicious L1 contract
2. Malicious contract calls `starknetCore.sendMessageToL2(l2Contract, selector, [attacker_address, 1000000])`
3. L2 handler processes message without checking sender
4. Attacker receives 1,000,000 tokens without depositing any funds
5. Protocol suffers infinite mint vulnerability
**Recommendation** :
Validate `from_address` against authorized L1 bridge:
```rust
#[l1_handler]
fn handle_deposit(
ref self: ContractState,
from_address: felt252,
user: ContractAddress,
amount: u256
) {
// Validate L1 sender
let authorized_l1_bridge = self.l1_bridge_address.read();
assert(from_address == authorized_l1_bridge, 'Unauthorized L1 sender');
let current_balance = self.balances.read(user);
self.balances.write(user, current_balance + amount);
}
```
**References** :
- building-secure-contracts/not-so-smart-contracts/cairo/unchecked_l1_ handler_from
- Caracal detector: `unchecked-l1-handler-from`
9. Priority Guidelines
Critical (Immediate Fix Required)
Unchecked from_address in L1 handlers (infinite mint)
L1-L2 address conversion issues (funds to zero address)
High (Fix Before Deployment)
Felt252 arithmetic overflow/underflow (balance manipulation)
Missing signature replay protection (replay attacks)
L1-L2 message failure without cancellation (locked funds)
Medium (Address in Audit)
Overconstrained L1-L2 interactions (trapped funds)
10. Testing Recommendations
Unit Tests #[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_felt252_overflow () {
}
#[test]
#[should_panic]
fn test_unauthorized_l1_handler () {
}
#[test]
fn test_signature_replay_protection () {
}
}
Integration Tests (with L1)
#[test]
fn test_deposit_withdraw_roundtrip () {
}
Caracal CI Integration
- name: Run Caracal
run: |
# Rebuilds from source each run; cache ~/.cargo or pin a release binary instead.
cargo install --git https://github.com/crytic/caracal --profile release --force
caracal detect src/ --fail-on high,critical
11. Additional Resources
12. Quick Reference Checklist Before completing Cairo/StarkNet audit:
Arithmetic Safety (HIGH) :
L1 Handler Security (CRITICAL) :
Signature Security (HIGH) :
