Solana vulnerability scanner: 6 critical audit patterns

Prerequisites: a Solana/Anchor program to audit (native Rust or Anchor) that you have the right to review; the rg CLI helpful for the sweep commands; no accounts or keys needed Install "Solana vulnerability scanner: 6 critical audit patterns" for me. A systematic audit contract for Solana programs: detect the project (Rust sources, Anchor.toml, solana-program/anchor-lang markers), then sweep 6 critical patterns — arbitrary CPI, improper PDA validation, missing ownership check, missing signer check, spoofed sysvar accounts, improper instruction introspection — emitting a full 6-row coverage table where every pattern carries a found/clear/n/a verdict with evidence, followed by file-and-line findings with attack scenarios and Anchor-idiomatic fixes, severity-ranked priorities, test recommendations and a final checklist. Includes rationalizations to reject and pointers to the Trail of Bits solana-lints and Building Secure Contracts corpus. Repository: https://github.com/trailofbits/skills/blob/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md 1. Fetch the SKILL.md file (and any helper files) from the repository path into a temporary folder and summarize what it does in one or two sentences. 2. Safety check: review the SKILL.md and scripts for anything suspicious (unexpected network calls, shell commands, credential harvesting). This repo should contain zero secrets in code, credentials only via the secure vault, allowed hosts declared in the SKILL.md. Verify that holds here; STOP on any red flag and tell me. 3. Install it as a skill: copy SKILL.md and its helper files into the agent's skills directory, in a folder named "solana-vulnerability-scanner". 4. Verify with no network calls: frontmatter valid, files in place. 5. Report what was installed, where, and what I still need to do myself (e.g. point it at a Solana program I have the right to audit; add the Trail of Bits solana-lints to Cargo.toml if wanted). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.