The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the Caracal static analysis tool directly from the 'crytic' GitHub repository (a Trail of Bits organization) using the command cargo install --git https://github.com/crytic/caracal. This is a standard installation method for Rust-based security tools provided by this vendor.
[COMMAND_EXECUTION]: The skill utilizes shell commands such as rg (ripgrep) to search for specific code patterns (e.g., felt252 usage) and caracal to execute static analysis detectors on the codebase. These commands are necessary for the skill's primary function of vulnerability detection.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and analyze untrusted external code (Cairo contracts), it possesses an attack surface for indirect prompt injection. A malicious contract could theoretically contain comments or code structures intended to influence the agent's behavior. The skill manages this risk by requiring a strict reporting format, including a mandatory 6-row coverage table, which forces the agent to explicitly check and report on pre-defined security patterns regardless of the input content.

cairo-vulnerability-scanner