trailofbits

Builds source and binary code graphs for security analysis, taint modeling with native analyzers, context slicing, mutation testing, cryptographic protocol modeling, finding triage, and variant analysis.

15 skills · 1 agent

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills

Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis

1 skill · 11 agents · 1 MCP server

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

11 skills

Agent-orchestrated skills for finding, reproducing and adjudicating regressions in PRs or commits.

7 skills

Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit confusion, decimals or scaling mismatches, WAD/RAY scale errors, or the wrong token's decimals; to annotate units in a codebase; or to perform a dimensional analysis of a DeFi protocol, offchain code, or other arithmetic-heavy codebase. Catches formulas that combine values carrying different units or scales.

1 skill · 5 agents

Systematic false positive verification for security bug analysis with mandatory gate reviews

1 skill · 3 agents · hooks

Agent-orchestrated workflow to reproduce, patch, prove and regression-check one known bug.

5 skills

Improves code targets — skills, plugins, or a branch's changes — through an autonomous review-and-fix workflow with a pluggable reviewer (any installed skill or agent), a cross-round findings ledger, oscillation escalation, and a mechanical scope guard.

3 skills · 1 agent

Comprehensive Rust security code review with specialized bug-finding agents covering the safe/unsafe boundary, memory safety in unsafe blocks, concurrency, panic-induced DoS, recursion-induced stack overflow, FFI, and async runtime hazards

1 skill · 3 agents

Security-focused differential review of code changes with git history analysis and blast radius estimation

1 skill · 1 command · 1 agent

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

3 skills

Understand a codebase before looking for bugs in it. Reads it function by function, records what each one assumes and depends on, and saves the write-ups to files instead of filling up the conversation.

1 skill · 1 agent

Search and extract data from Burp Suite project files (.burp) for security analysis

1 skill · 1 command

Detect compiler-induced timing side-channels in cryptographic code

1 skill · 1 command

Comprehensive C/C++ security code review, with coverage verified against a parse of the source

1 skill · 1 agent

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

1 skill · 1 command

Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

1 skill · 1 command

Intercepts GitHub URL fetches (WebFetch and MCP fetch tools) and curl/wget commands, redirecting to the authenticated gh CLI.

1 skill · hooks

Draws the 12 Houses of the Zodiac Tarot spread using cryptographic randomness to add 100+ bits of entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous.

1 skill · 1 agent

Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.

1 skill · hooks

Create custom Semgrep rules for detecting bug patterns and security vulnerabilities

1 skill · 1 command

Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes

1 skill · 1 agent

Check code against the documentation that specifies it: one agent per requirement, divergences refuted before they are reported, evidence cited to the line

1 skill · 1 agent

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)

1 skill

Diagnose and fix Claude in Chrome MCP extension connectivity issues

1 skill

Interprets Culture Index survey results for individuals and teams

1 skill

Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector, or estimating severity.

1 skill

Create pre-configured devcontainers with Claude Code and language-specific tooling

1 skill

Analyze DWARF debug information: parse and search DIEs with dwarfdump and readelf, verify debug info integrity, and write DWARF parsing code

1 skill

Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.

1 command

Triages a repository's open GitHub issues and pull requests via the gh CLI: optionally merges ready bot and maintainer-approved PRs and spawns review subagents for unreviewed ones, closes already-resolved issues with referenced explanations, cross-links issues with pending fix PRs, and assigns local-only priority and change-size estimates.

1 skill

Drafts copy-ready /goal commands for goal mode in Claude Code and Codex: verifiable completion conditions with stop bounds, normalized to a single line under the 4,000-character cap.

1 skill

Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production

1 command

Modern C++ best practices (C++20/23/26). Use when writing C++ code, creating new C++ projects, or modernizing legacy C++ patterns.

1 skill

Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.

1 skill

Prepares a repository for public open-source release: secrets-history hygiene, license selection, documentation and CI readiness checks, and language-specific packaging and release guidance.

1 skill

Validates security patches against the reported bug, root-cause variants, and surrounding behavior. Returns reproducible failures to repair and validation gaps, with pinned inputs and saved evidence. Bundles a validate-patch dynamic workflow for Claude Code.

1 skill

Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants

1 skill

Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.

1 skill

Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits.

1 skill

Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation

1 skill

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

1 skill

Find similar vulnerabilities and bugs across codebases using pattern-based analysis

1 skill

Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.

1 skill

Structured Lean 4 proof writing and library design following Mathlib conventions

1 skill

YARA-X detection rule authoring with linting and quality analysis

1 skill