Source

trailofbits/skills

91 skills · 350.3K combined installs

Skills from this source

#

Skill

Source

8W Activity

Installs

semgrep Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit app…

trailofbits/skills

modern-python Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts…

trailofbits/skills

codeql Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. T…

trailofbits/skills

ask-questions-if-underspecified Clarify requirements before implementing. Use when serious doubts arise.

trailofbits/skills

supply-chain-risk-auditor Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the ful…

trailofbits/skills

insecure-defaults Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecu…

trailofbits/skills

secure-workflow-guide Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgrad…

trailofbits/skills

differential-review Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame…

trailofbits/skills

code-maturity-assessor Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safet…

trailofbits/skills

fp-check Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSI…

trailofbits/skills

agentic-actions-auditor Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, G…

trailofbits/skills

gh-cli Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working…

trailofbits/skills

audit-context-building Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it dep…

trailofbits/skills

property-based-testing Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Med…

trailofbits/skills

sharp-edges Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when re…

trailofbits/skills

variant-analysis Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediat…

trailofbits/skills

sarif-parsing Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "par…

trailofbits/skills

spec-to-code-compliance Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which a…

trailofbits/skills

solana-vulnerability-scanner Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer…

trailofbits/skills

semgrep-rule-creator Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writin…

trailofbits/skills

audit-prep-assistant Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis t…

trailofbits/skills

entry-point-analyzer Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally c…

trailofbits/skills

token-integration-analyzer Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token imp…

trailofbits/skills

coverage-analysis Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage ou…

trailofbits/skills

guidelines-advisor Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentatio…

trailofbits/skills

firebase-apk-scanner Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication …

trailofbits/skills

harness-writing Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating str…

trailofbits/skills

constant-time-analysis Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, en…

trailofbits/skills

fuzzing-obstacles Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation…

trailofbits/skills

address-sanitizer Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during…

trailofbits/skills

cargo-fuzz Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nig…

trailofbits/skills

cosmos-vulnerability-scanner Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund…

trailofbits/skills

semgrep-rule-variant-creator Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. T…

trailofbits/skills

fuzzing-dictionary Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expect…

trailofbits/skills

testing-handbook-generator Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emi…

trailofbits/skills

algorand-vulnerability-scanner Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, …

trailofbits/skills

cairo-vulnerability-scanner Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 mess…

trailofbits/skills

constant-time-testing Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis…

trailofbits/skills

dwarf-expert Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/D…

trailofbits/skills

libfuzzer Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Cover…

trailofbits/skills

ossfuzz Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Cover…

trailofbits/skills

substrate-vulnerability-scanner Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect w…

trailofbits/skills

ton-vulnerability-scanner Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake…

trailofbits/skills

interpreting-culture-index Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual prof…

trailofbits/skills

atheris Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, Fuzzed…

trailofbits/skills

aflpp Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers ins…

trailofbits/skills

wycheproof Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edg…

trailofbits/skills

libafl Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators,…

trailofbits/skills

second-opinion Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or spec…

trailofbits/skills

devcontainer-setup Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use …

trailofbits/skills