trailofbits/skills

Agent skills in the GitHub repository trailofbits/skills, each with its code score out of 100.

Trail of Bits skills for security research, vulnerability detection, and audit workflows

Repository score

67 / 100 C

Skills

96

Verified

10

Average skill score

68

GitHub stars

8,147

License

CC-BY-SA-4.0

Open trailofbits/skills on GitHub

96 skills in this repository

1. cvss-scoring

   Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector,…

   Verified85A
2. cosmos-vulnerability-scanner

   Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWas…

   Verified84B
3. codeql

   Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database…

   Verified83B
4. graph-evolution

   Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexi…

   Verified82B
5. post-patch-validation

   Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly intr…

   Verified82B
6. semgrep

   Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-sc…

   Verified82B
7. yara-rule-authoring

   Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string select…

   Verified81B
8. crypto-protocol-diagram

   Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagra…

   Verified80B
9. sarif-parsing

   Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "dedupli…

   Verified80B
10. testing-handbook-generator

    Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requir…

    Verified80B
11. skill-improver

    Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converg…

    79B
12. mermaid-to-proverif

    Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifyi…

    78B
13. rust-review

    Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime…

    78B
14. pr-improver

    Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched.…

    76B
15. devcontainer-setup

    Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isol…

    74B
16. open-sourcing

    This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "…

    74B
17. trailmark-structural

    Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and versio…

    74B
18. vector-forge

    Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test…

    74B
19. writing-lean-proofs

    Writes and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications…

    74B
20. zeroize-audit

    Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verificat…

    74B
21. sharp-edges

    Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic libr…

    73B
22. slicing-code-context

    Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class…

    73B
23. fp-check

    Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked…

    72B
24. modern-python

    Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

    72B
25. ruzzy

    Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C…

    72B
26. trailmark-summary

    Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural o…

    72B
27. diagramming-code

    Generates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack surfa…

    71B
28. entry-point-analyzer

    Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by acces…

    71B
29. github-triage

    Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintaine…

    71B
30. goal-prompt

    Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal pro…

    71B
31. modern-cpp

    Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with sma…

    71B
32. algorand-vulnerability-scanner

    Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when…

    70B
33. audit-prep-assistant

    Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures acce…

    70B
34. burpsuite-project-parser

    Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings…

    70B
35. code-improver

    Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Ke…

    70B
36. firebase-apk-scanner

    Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK fi…

    70B
37. genotoxic

    Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call gra…

    70B
38. secure-workflow-guide

    Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual…

    70B
39. semgrep-rule-creator

    Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

    70B
40. vulnerability-triage-brocards

    This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a secu…

    70B
41. agentic-actions-auditor

    Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects atta…

    69C
42. cairo-vulnerability-scanner

    Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature repla…

    69C
43. chrome-mcp-troubleshooting

    Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratical…

    69C
44. differential-review

    Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, che…

    69C
45. guidelines-advisor

    Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability pa…

    69C
46. harness-writing

    Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, an…

    69C
47. patching-bugs

    Use when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.

    69C
48. solana-vulnerability-scanner

    Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Sola…

    69C
49. trailmark

    Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entr…

    69C
50. constant-time-testing

    Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the for…

    68C
51. dwarf-expert

    Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verify…

    68C
52. fuzzing-obstacles

    Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state.…

    68C
53. dimensional-analysis

    Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit…

    67C
54. let-fate-decide

    Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps.…

    67C
55. trailmark-review-gate

    Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or…

    67C
56. constant-time-analysis

    Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or…

    66C
57. reproduce-bug

    Use when a named runtime or compiler bug in a local repository needs independent reproduction.

    66C
58. semgrep-rule-variant-creator

    Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces…

    66C
59. substrate-vulnerability-scanner

    Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate run…

    66C
60. ton-vulnerability-scanner

    Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use whe…

    66C
61. address-sanitizer

    Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTI…

    64C
62. atheris

    Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C exte…

    64C
63. audit-augmentation

    Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph e…

    64C
64. code-maturity-assessor

    Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentrali…

    64C
65. libafl

    Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer for targets the stand…

    64C
66. libfuzzer

    Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dict…

    64C
67. c-review

    Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ appli…

    63C
68. cargo-fuzz

    Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-…

    63C
69. mutation-testing

    Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, id…

    63C
70. supply-chain-risk-auditor

    Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publishe…

    63C
71. trailmark-finding-triage

    Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint path…

    63C
72. implement-patch

    Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.

    62C
73. ossfuzz

    Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scri…

    62C
74. replay-regression

    Use when independently verifying a supplied PoC against fresh live before/after deployments.

    62C
75. reproduce-regression

    Use when deploying before/after systems and building a live-system PoC for a regression candidate.

    62C
76. review-walkthrough

    Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.

    62C
77. token-integration-analyzer

    Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird…

    62C
78. validate-bug

    Use when a bug PoC package needs an independent rerun and judgment before patching.

    62C
79. fuzzing-dictionary

    Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, an…

    61C
80. prove-patch

    Use when a local security patch commit needs independent scoped and three-arm proof.

    60C
81. spec-to-code-compliance

    Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. U…

    60C
82. aflpp

    Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, per…

    59C
83. interpreting-culture-index

    Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue)…

    58C
84. property-based-testing

    Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a…

    58C
85. variant-analysis

    Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up…

    58C
86. wycheproof

    Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading…

    58C
87. adjudicate-regression

    Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.

    57C
88. hunt-regressions

    Use when discovering possible regressions from a pinned change and its callers before reproduction.

    57C
89. regression-hunt

    Use when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.

    57C
90. trailmark-variant-neighborhood

    Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensiti…

    57C
91. second-opinion

    Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code…

    56C
92. prepare-regression

    Use when pinning before/after sources and collecting PR or commit context for a regression investigation.

    55C
93. coverage-analysis

    Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage repor…

    54D
94. gh-cli

    Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

    52D
95. report-regressions

    Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.

    50D
96. audit-context-building

    Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, o…

    45D

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.