---
title: "Substrate Vulnerability Scanner - Air Market"
description: "You are working on a Substrate or Polkadot runtime and want the known dangerous patterns checked before an audit. This scans your pallets for a set of critical issues - arithmetic overflow, panics th…"
canonical: "https://airmarket.ai/app/substrate-vulnerability-scanner"
---

[Air Market](/) / [Security](/category/security) / Substrate Vulnerability Scanner

Skill by [Trail of Bits](/@trailofbits)

# Substrate Vulnerability Scanner

Check your pallets for the failures that take a chain down

## What this does

You are working on a Substrate or Polkadot runtime and want the known dangerous patterns checked before an audit. This scans your pallets for a set of critical issues - arithmetic overflow, panics that can stall things, weights that are wrong, and origin checks that let the wrong caller through.

### Top 3 things it does for you

- Scan my FRAME pallet for critical issues
- Check for overflow and panic risks in a runtime
- Review whether my origin checks and weights hold up

## Information

**Substrate Vulnerability Scanner at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Trail of Bits](/@trailofbits) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 37 KB |
| Licence | CC-BY-SA-4.0 |
| Repository | [trailofbits/skills](https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner) |
| GitHub stars | 6,823 (as of Nov 2026) |
| Installs | 5,543, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Substrate Vulnerability Scanner and flagged nothing. AIR's verdict: **safe**.

**What Substrate Vulnerability Scanner's check was run against**

|  |  |
| --- | --- |
| Commit | d5fe2e6a7896236c3102fd5477e833623ad70298 |
| Content hash | 2c834121dc6af31203c770496dc6a30dc060c680e9cd8433d048c2c72a8a720b |
| Files read | [Browse the files at this exact commit](https://github.com/trailofbits/skills/blob/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Substrate Vulnerability Scanner](/security/substrate-vulnerability-scanner)

## About Substrate Vulnerability Scanner

This scans Substrate and Polkadot pallets for a set of critical vulnerabilities, including arithmetic overflow, panic-based denial of service, incorrect weights, and bad origin checks.

Use it when auditing Substrate runtimes or FRAME pallets.

## What's inside

- SKILL.md - instructions
- agents/openai.yaml - data
- assets/trail-of-bits-mark.svg - template
- resources/VULNERABILITY_PATTERNS.md - reference

## Questions

### Is Substrate Vulnerability Scanner safe to install?

AIR scanned this exact version of Substrate Vulnerability Scanner and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit d5fe2e6a7896, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/substrate-vulnerability-scanner.

### How do I install Substrate Vulnerability Scanner?

Open https://airmarket.ai/app/substrate-vulnerability-scanner on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trailofbits/skills/tree/d5fe2e6a7896236c3102fd5477e833623ad70298/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Trail of Bits](/@trailofbits)

---

Canonical URL: <https://airmarket.ai/app/substrate-vulnerability-scanner>