[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSRTF811B035KYTQ28JBWS":3,"skill-same:01M6DSRTF811B035KYTQ28JBWS":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":39,"install":40,"resources":53},"01M6DSRTF811B035KYTQ28JBWS","substrate-vulnerability-scanner",null,"Scans Substrate\u002FPolkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fsubstrate-vulnerability-scanner\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27],"substrate","vulnerability","vulnerability scanner","scanner","substrate vulnerability scanner","vulnerabilities","use","bad","origin","critical","2026-11-10 10:12:30",false,"---\nname: substrate-vulnerability-scanner\ndescription: Scans Substrate\u002FPolkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.\n---\n\n# Substrate Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Substrate runtime modules (pallets) for platform-specific security vulnerabilities that can cause node crashes, DoS attacks, or unauthorized access. This skill encodes 7 critical vulnerability patterns unique to Substrate\u002FFRAME-based chains.\n\n## 2. When to Use This Skill\n\n- Auditing custom Substrate pallets\n- Reviewing FRAME runtime code\n- Pre-launch security assessment of Substrate chains (Polkadot parachains, standalone chains)\n- Validating dispatchable extrinsic functions\n- Reviewing weight calculation functions\n- Assessing unsigned transaction validation logic\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Rust files**: `.rs`\n\n### Language\u002FFramework Markers\n```rust\n\u002F\u002F Substrate\u002FFRAME indicators\n#[pallet]\npub mod pallet {\n    use frame_support::pallet_prelude::*;\n    use frame_system::pallet_prelude::*;\n\n    #[pallet::config]\n    pub trait Config: frame_system::Config { }\n\n    #[pallet::call]\n    impl\u003CT: Config> Pallet\u003CT> {\n        #[pallet::weight(10_000)]\n        pub fn example_function(origin: OriginFor\u003CT>) -> DispatchResult { }\n    }\n}\n\n\u002F\u002F Common patterns\nDispatchResult, DispatchError\nensure!, ensure_signed, ensure_root\nStorageValue, StorageMap, StorageDoubleMap\n#[pallet::storage]\n#[pallet::call]\n#[pallet::weight]\n#[pallet::validate_unsigned]\n```\n\n### Project Structure\n- `pallets\u002F*\u002Flib.rs` - Pallet implementations\n- `runtime\u002Flib.rs` - Runtime configuration\n- `benchmarking.rs` - Weight benchmarks\n- `Cargo.toml` with `frame-*` dependencies\n\n### Tool Support\n- **cargo-fuzz**: Fuzz testing for Rust\n- **test-fuzz**: Property-based testing framework\n- **benchmarking framework**: Built-in weight calculation\n- **try-runtime**: Runtime migration testing\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Substrate pallets\n2. **Analyze each pallet** for the 7 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check weight calculations** and origin validation\n\n---\n\n## 5. Vulnerability Patterns (7 Critical Patterns)\n\nI check for 7 critical vulnerability patterns unique to Substrate\u002FFRAME. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Arithmetic Overflow** ⚠️ CRITICAL\n   - Direct `+`, `-`, `*`, `\u002F` operators wrap in release mode\n   - Must use `checked_*` or `saturating_*` methods\n   - Affects balance\u002Ftoken calculations, reward\u002Ffee math\n\n2. **Don't Panic** ⚠️ CRITICAL - DoS\n   - Panics cause node to stop processing blocks\n   - No `unwrap()`, `expect()`, array indexing without bounds check\n   - All user input must be validated with `ensure!`\n\n3. **Weights and Fees** ⚠️ CRITICAL - DoS\n   - Incorrect weights allow spam attacks\n   - Fixed weights for variable-cost operations enable DoS\n   - Must use benchmarking framework, bound all input parameters\n\n4. **Verify First, Write Last** ⚠️ HIGH (Pre-v0.9.25)\n   - Storage writes before validation persist on error (pre-v0.9.25)\n   - Pattern: validate → write → emit event\n   - Upgrade to v0.9.25+ or use manual `#[transactional]`\n\n5. **Unsigned Transaction Validation** ⚠️ HIGH\n   - Insufficient validation allows spam\u002Freplay attacks\n   - Prefer signed transactions\n   - If unsigned: validate parameters, replay protection, authenticate source\n\n6. **Bad Randomness** ⚠️ MEDIUM\n   - `pallet_randomness_collective_flip` vulnerable to collusion\n   - Must use BABE randomness (`pallet_babe::RandomnessFromOneEpochAgo`)\n   - Use `random(subject)` not `random_seed()`\n\n7. **Bad Origin** ⚠️ CRITICAL\n   - `ensure_signed` allows any user for privileged operations\n   - Must use `ensure_root` or custom origins (ForceOrigin, AdminOrigin)\n   - Origin types must be properly configured in runtime\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n---\n\n## 6. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Substrate\u002FFRAME framework usage\n2. Check Substrate version (v0.9.25+ has transactional storage)\n3. Locate pallet implementations (`pallets\u002F*\u002Flib.rs`)\n4. Identify runtime configuration (`runtime\u002Flib.rs`)\n\n### Step 2: Dispatchable Analysis\nFor each `#[pallet::call]` function:\n- [ ] Arithmetic: Uses checked\u002Fsaturating operations?\n- [ ] Panics: No unwrap\u002Fexpect\u002Findexing?\n- [ ] Weights: Proportional to cost, bounded inputs?\n- [ ] Origin: Appropriate validation level?\n- [ ] Validation: All checks before storage writes?\n\n### Step 3: Panic Sweep\n```bash\n# Search for panic-prone patterns\nrg \"unwrap\\(\\)\" pallets\u002F\nrg \"expect\\(\" pallets\u002F\nrg \"\\[.*\\]\" pallets\u002F  # Array indexing\nrg \" as u\\d+\" pallets\u002F  # Type casts\nrg \"\\.unwrap_or\" pallets\u002F\n```\n\n### Step 4: Arithmetic Safety Check\n```bash\n# Find direct arithmetic\nrg \" \\+ |\\+=| - |-=| \\* |\\*=| \u002F |\u002F=\" pallets\u002F\n\n# Should find checked\u002Fsaturating alternatives instead\nrg \"checked_add|checked_sub|checked_mul|checked_div\" pallets\u002F\nrg \"saturating_add|saturating_sub|saturating_mul\" pallets\u002F\n```\n\n### Step 5: Weight Analysis\n- [ ] Run benchmarking: `cargo test --features runtime-benchmarks`\n- [ ] Verify weights match computational cost\n- [ ] Check for bounded input parameters\n- [ ] Review weight calculation functions\n\n### Step 6: Origin & Privilege Review\n```bash\n# Find privileged operations\nrg \"ensure_signed\" pallets\u002F | grep -E \"pause|emergency|admin|force|sudo\"\n\n# Should use ensure_root or custom origins\nrg \"ensure_root|ForceOrigin|AdminOrigin\" pallets\u002F\n```\n\n### Step 7: Testing Review\n- [ ] Unit tests cover all dispatchables\n- [ ] Fuzz tests for panic conditions\n- [ ] Benchmarks for weight calculation\n- [ ] try-runtime tests for migrations\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Arithmetic overflow (token creation, balance manipulation)\n- Panic DoS (node crash risk)\n- Bad origin (unauthorized privileged operations)\n\n### High (Fix Before Launch)\n- Incorrect weights (DoS via spam)\n- Verify-first violations (state corruption, pre-v0.9.25)\n- Unsigned validation issues (spam, replay attacks)\n\n### Medium (Address in Audit)\n- Bad randomness (manipulation possible but limited impact)\n\n---\n\n## 8. Testing Recommendations\n\n### Fuzz Testing\n```rust\n\u002F\u002F Use test-fuzz for property-based testing\n#[cfg(test)]\nmod tests {\n    use test_fuzz::test_fuzz;\n\n    #[test_fuzz]\n    fn fuzz_transfer(from: AccountId, to: AccountId, amount: u128) {\n        \u002F\u002F Should never panic\n        let _ = Pallet::transfer(from, to, amount);\n    }\n\n    #[test_fuzz]\n    fn fuzz_no_panics(call: Call) {\n        \u002F\u002F No dispatchable should panic\n        let _ = call.dispatch(origin);\n    }\n}\n```\n\n### Benchmarking\n```bash\n# Run benchmarks to generate weights\ncargo build --release --features runtime-benchmarks\n.\u002Ftarget\u002Frelease\u002Fnode benchmark pallet \\\n    --chain dev \\\n    --pallet pallet_example \\\n    --extrinsic \"*\" \\\n    --steps 50 \\\n    --repeat 20\n```\n\n### try-runtime\n```bash\n# Test runtime upgrades\ncargo build --release --features try-runtime\ntry-runtime --runtime .\u002Ftarget\u002Frelease\u002Fwbuild\u002Fruntime.wasm \\\n    on-runtime-upgrade live --uri wss:\u002F\u002Frpc.polkadot.io\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fsubstrate\u002F`\n- **Substrate Documentation**: https:\u002F\u002Fdocs.substrate.io\u002F\n- **FRAME Documentation**: https:\u002F\u002Fparitytech.github.io\u002Fsubstrate\u002Fmaster\u002Fframe_support\u002F\n- **test-fuzz**: https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Ftest-fuzz\n- **Substrate StackExchange**: https:\u002F\u002Fsubstrate.stackexchange.com\u002F\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Substrate pallet audit:\n\n**Arithmetic Safety (CRITICAL)**:\n- [ ] No direct `+`, `-`, `*`, `\u002F` operators in dispatchables\n- [ ] All arithmetic uses `checked_*` or `saturating_*`\n- [ ] Type conversions use `try_into()` with error handling\n\n**Panic Prevention (CRITICAL)**:\n- [ ] No `unwrap()` or `expect()` in dispatchables\n- [ ] No direct array\u002Fslice indexing without bounds check\n- [ ] All user inputs validated with `ensure!`\n- [ ] Division operations check for zero divisor\n\n**Weights & DoS (CRITICAL)**:\n- [ ] Weights proportional to computational cost\n- [ ] Input parameters have maximum bounds\n- [ ] Benchmarking used to determine weights\n- [ ] No free (zero-weight) expensive operations\n\n**Access Control (CRITICAL)**:\n- [ ] Privileged operations use `ensure_root` or custom origins\n- [ ] `ensure_signed` only for user-level operations\n- [ ] Origin types properly configured in runtime\n- [ ] Sudo pallet removed before production\n\n**Storage Safety (HIGH)**:\n- [ ] Using Substrate v0.9.25+ OR manual `#[transactional]`\n- [ ] Validation before storage writes\n- [ ] Events emitted after successful operations\n\n**Other (MEDIUM)**:\n- [ ] Unsigned transactions use signed alternative if possible\n- [ ] If unsigned: proper validation, replay protection, authentication\n- [ ] BABE randomness used (not RandomnessCollectiveFlip)\n- [ ] Randomness uses `random(subject)` not `random_seed()`\n\n**Testing**:\n- [ ] Unit tests for all dispatchables\n- [ ] Fuzz tests to find panics\n- [ ] Benchmarks generated and verified\n- [ ] try-runtime tests for migrations\n","# Substrate Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Substrate runtime modules (pallets) for platform-specific security vulnerabilities that can cause node crashes, DoS attacks, or unauthorized access. This skill encodes 7 critical vulnerability patterns unique to Substrate\u002FFRAME-based chains.\n\n## 2. When to Use This Skill\n\n- Auditing custom Substrate pallets\n- Reviewing FRAME runtime code\n- Pre-launch security assessment of Substrate chains (Polkadot parachains, standalone chains)\n- Validating dispatchable extrinsic functions\n- Reviewing weight calculation functions\n- Assessing unsigned transaction validation logic\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Rust files**: `.rs`\n\n### Language\u002FFramework Markers\n```rust\n\u002F\u002F Substrate\u002FFRAME indicators\n#[pallet]\npub mod pallet {\n    use frame_support::pallet_prelude::*;\n    use frame_system::pallet_prelude::*;\n\n    #[pallet::config]\n    pub trait Config: frame_system::Config { }\n\n    #[pallet::call]\n    impl\u003CT: Config> Pallet\u003CT> {\n        #[pallet::weight(10_000)]\n        pub fn example_function(origin: OriginFor\u003CT>) -> DispatchResult { }\n    }\n}\n\n\u002F\u002F Common patterns\nDispatchResult, DispatchError\nensure!, ensure_signed, ensure_root\nStorageValue, StorageMap, StorageDoubleMap\n#[pallet::storage]\n#[pallet::call]\n#[pallet::weight]\n#[pallet::validate_unsigned]\n```\n\n### Project Structure\n- `pallets\u002F*\u002Flib.rs` - Pallet implementations\n- `runtime\u002Flib.rs` - Runtime configuration\n- `benchmarking.rs` - Weight benchmarks\n- `Cargo.toml` with `frame-*` dependencies\n\n### Tool Support\n- **cargo-fuzz**: Fuzz testing for Rust\n- **test-fuzz**: Property-based testing framework\n- **benchmarking framework**: Built-in weight calculation\n- **try-runtime**: Runtime migration testing\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Substrate pallets\n2. **Analyze each pallet** for the 7 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check weight calculations** and origin validation\n\n---\n\n## 5. Vulnerability Patterns (7 Critical Patterns)\n\nI check for 7 critical vulnerability patterns unique to Substrate\u002FFRAME. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Arithmetic Overflow** ⚠️ CRITICAL\n   - Direct `+`, `-`, `*`, `\u002F` operators wrap in release mode\n   - Must use `checked_*` or `saturating_*` methods\n   - Affects balance\u002Ftoken calculations, reward\u002Ffee math\n\n2. **Don't Panic** ⚠️ CRITICAL - DoS\n   - Panics cause node to stop processing blocks\n   - No `unwrap()`, `expect()`, array indexing without bounds check\n   - All user input must be validated with `ensure!`\n\n3. **Weights and Fees** ⚠️ CRITICAL - DoS\n   - Incorrect weights allow spam attacks\n   - Fixed weights for variable-cost operations enable DoS\n   - Must use benchmarking framework, bound all input parameters\n\n4. **Verify First, Write Last** ⚠️ HIGH (Pre-v0.9.25)\n   - Storage writes before validation persist on error (pre-v0.9.25)\n   - Pattern: validate → write → emit event\n   - Upgrade to v0.9.25+ or use manual `#[transactional]`\n\n5. **Unsigned Transaction Validation** ⚠️ HIGH\n   - Insufficient validation allows spam\u002Freplay attacks\n   - Prefer signed transactions\n   - If unsigned: validate parameters, replay protection, authenticate source\n\n6. **Bad Randomness** ⚠️ MEDIUM\n   - `pallet_randomness_collective_flip` vulnerable to collusion\n   - Must use BABE randomness (`pallet_babe::RandomnessFromOneEpochAgo`)\n   - Use `random(subject)` not `random_seed()`\n\n7. **Bad Origin** ⚠️ CRITICAL\n   - `ensure_signed` allows any user for privileged operations\n   - Must use `ensure_root` or custom origins (ForceOrigin, AdminOrigin)\n   - Origin types must be properly configured in runtime\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n---\n\n## 6. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Substrate\u002FFRAME framework usage\n2. Check Substrate version (v0.9.25+ has transactional storage)\n3. Locate pallet implementations (`pallets\u002F*\u002Flib.rs`)\n4. Identify runtime configuration (`runtime\u002Flib.rs`)\n\n### Step 2: Dispatchable Analysis\nFor each `#[pallet::call]` function:\n- [ ] Arithmetic: Uses checked\u002Fsaturating operations?\n- [ ] Panics: No unwrap\u002Fexpect\u002Findexing?\n- [ ] Weights: Proportional to cost, bounded inputs?\n- [ ] Origin: Appropriate validation level?\n- [ ] Validation: All checks before storage writes?\n\n### Step 3: Panic Sweep\n```bash\n# Search for panic-prone patterns\nrg \"unwrap\\(\\)\" pallets\u002F\nrg \"expect\\(\" pallets\u002F\nrg \"\\[.*\\]\" pallets\u002F  # Array indexing\nrg \" as u\\d+\" pallets\u002F  # Type casts\nrg \"\\.unwrap_or\" pallets\u002F\n```\n\n### Step 4: Arithmetic Safety Check\n```bash\n# Find direct arithmetic\nrg \" \\+ |\\+=| - |-=| \\* |\\*=| \u002F |\u002F=\" pallets\u002F\n\n# Should find checked\u002Fsaturating alternatives instead\nrg \"checked_add|checked_sub|checked_mul|checked_div\" pallets\u002F\nrg \"saturating_add|saturating_sub|saturating_mul\" pallets\u002F\n```\n\n### Step 5: Weight Analysis\n- [ ] Run benchmarking: `cargo test --features runtime-benchmarks`\n- [ ] Verify weights match computational cost\n- [ ] Check for bounded input parameters\n- [ ] Review weight calculation functions\n\n### Step 6: Origin & Privilege Review\n```bash\n# Find privileged operations\nrg \"ensure_signed\" pallets\u002F | grep -E \"pause|emergency|admin|force|sudo\"\n\n# Should use ensure_root or custom origins\nrg \"ensure_root|ForceOrigin|AdminOrigin\" pallets\u002F\n```\n\n### Step 7: Testing Review\n- [ ] Unit tests cover all dispatchables\n- [ ] Fuzz tests for panic conditions\n- [ ] Benchmarks for weight calculation\n- [ ] try-runtime tests for migrations\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Arithmetic overflow (token creation, balance manipulation)\n- Panic DoS (node crash risk)\n- Bad origin (unauthorized privileged operations)\n\n### High (Fix Before Launch)\n- Incorrect weights (DoS via spam)\n- Verify-first violations (state corruption, pre-v0.9.25)\n- Unsigned validation issues (spam, replay attacks)\n\n### Medium (Address in Audit)\n- Bad randomness (manipulation possible but limited impact)\n\n---\n\n## 8. Testing Recommendations\n\n### Fuzz Testing\n```rust\n\u002F\u002F Use test-fuzz for property-based testing\n#[cfg(test)]\nmod tests {\n    use test_fuzz::test_fuzz;\n\n    #[test_fuzz]\n    fn fuzz_transfer(from: AccountId, to: AccountId, amount: u128) {\n        \u002F\u002F Should never panic\n        let _ = Pallet::transfer(from, to, amount);\n    }\n\n    #[test_fuzz]\n    fn fuzz_no_panics(call: Call) {\n        \u002F\u002F No dispatchable should panic\n        let _ = call.dispatch(origin);\n    }\n}\n```\n\n### Benchmarking\n```bash\n# Run benchmarks to generate weights\ncargo build --release --features runtime-benchmarks\n.\u002Ftarget\u002Frelease\u002Fnode benchmark pallet \\\n    --chain dev \\\n    --pallet pallet_example \\\n    --extrinsic \"*\" \\\n    --steps 50 \\\n    --repeat 20\n```\n\n### try-runtime\n```bash\n# Test runtime upgrades\ncargo build --release --features try-runtime\ntry-runtime --runtime .\u002Ftarget\u002Frelease\u002Fwbuild\u002Fruntime.wasm \\\n    on-runtime-upgrade live --uri wss:\u002F\u002Frpc.polkadot.io\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fsubstrate\u002F`\n- **Substrate Documentation**: https:\u002F\u002Fdocs.substrate.io\u002F\n- **FRAME Documentation**: https:\u002F\u002Fparitytech.github.io\u002Fsubstrate\u002Fmaster\u002Fframe_support\u002F\n- **test-fuzz**: https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Ftest-fuzz\n- **Substrate StackExchange**: https:\u002F\u002Fsubstrate.stackexchange.com\u002F\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Substrate pallet audit:\n\n**Arithmetic Safety (CRITICAL)**:\n- [ ] No direct `+`, `-`, `*`, `\u002F` operators in dispatchables\n- [ ] All arithmetic uses `checked_*` or `saturating_*`\n- [ ] Type conversions use `try_into()` with error handling\n\n**Panic Prevention (CRITICAL)**:\n- [ ] No `unwrap()` or `expect()` in dispatchables\n- [ ] No direct array\u002Fslice indexing without bounds check\n- [ ] All user inputs validated with `ensure!`\n- [ ] Division operations check for zero divisor\n\n**Weights & DoS (CRITICAL)**:\n- [ ] Weights proportional to computational cost\n- [ ] Input parameters have maximum bounds\n- [ ] Benchmarking used to determine weights\n- [ ] No free (zero-weight) expensive operations\n\n**Access Control (CRITICAL)**:\n- [ ] Privileged operations use `ensure_root` or custom origins\n- [ ] `ensure_signed` only for user-level operations\n- [ ] Origin types properly configured in runtime\n- [ ] Sudo pallet removed before production\n\n**Storage Safety (HIGH)**:\n- [ ] Using Substrate v0.9.25+ OR manual `#[transactional]`\n- [ ] Validation before storage writes\n- [ ] Events emitted after successful operations\n\n**Other (MEDIUM)**:\n- [ ] Unsigned transactions use signed alternative if possible\n- [ ] If unsigned: proper validation, replay protection, authentication\n- [ ] BABE randomness used (not RandomnessCollectiveFlip)\n- [ ] Randomness uses `random(subject)` not `random_seed()`\n\n**Testing**:\n- [ ] Unit tests for all dispatchables\n- [ ] Fuzz tests to find panics\n- [ ] Benchmarks generated and verified\n- [ ] try-runtime tests for migrations\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Fsubstrate-vulnerability-scanner",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill substrate-vulnerability-scanner",{"tool":46,"command":47},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill substrate-vulnerability-scanner",{"tool":49,"command":50},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill substrate-vulnerability-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fsubstrate-vulnerability-scanner\u002FSKILL.md",true,[54],{"path":55,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":59},"resources\u002FVULNERABILITY_PATTERNS.md","REFERENCE","参考文档",24903,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fsubstrate-vulnerability-scanner\u002Fresources\u002FVULNERABILITY_PATTERNS.md",[61,86,101,116,129,142],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":80,"publishedAt":28},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[67,72,75],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":73,"categoryName":74,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[81,82,24,83,84,85],"writing skills","writing","editing","work","deployment",{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":94,"publishedAt":28},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[92,93],{"categoryNo":73,"categoryName":74,"taxonomyType":70,"taxonomyTypeDesc":71},{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},[95,96,82,97,98,24,99,100],"plans","writing plans","requirements","task","code","spec",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":109,"publishedAt":28},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[107,108],{"categoryNo":73,"categoryName":74,"taxonomyType":70,"taxonomyTypeDesc":71},{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},[110,111,112,113,114,115,82],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":28},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[118,123,124,125,126,127,128],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":28},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[136,137,138,139,99,140,141],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":28},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[149,137,150,84,24,151,152,153],"verification before completion","commands","evidence","claim","complete"]