Address Sanitizer
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds…
Security
Trail of Bits8k
Publisher Official
Trail of Bits skills for Claude
- trailofbits/skills
Trail of Bits skills for security research, vulnerability detection, and audit workflows
8k starsCC-BY-SA-4.095 skillsPlugin marketplace:
trailofbits Maintain trailofbits/skills?
Add the badge to your README so people can find the install steps.
[](https://www.stealit.xyz/publishers/trailofbits)
All 95 skills from Trail of Bits
95 skills
Adjudicate Regression
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
SecurityTrail of Bits8k
Aflpp
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns…
SecurityTrail of Bits8k
Agentic Actions Auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects…
SecurityTrail of Bits8k
Algorand Vulnerability Scanner
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when…
SecurityTrail of Bits8k
Atheris
Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C…
SecurityTrail of Bits8k
Audit Augmentation
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph…
SecurityTrail of Bits8k
Audit Context Building
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model…
SecurityTrail of Bits8k
Audit Prep Assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures…
SecurityTrail of Bits8k
Burpsuite Project Parser
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit…
SecurityTrail of Bits8k
C Review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++…
SecurityTrail of Bits8k
Cairo Vulnerability Scanner
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature…
SecurityTrail of Bits8k
Cargo Fuzz
Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses…
SecurityTrail of Bits8k
Chrome MCP Troubleshooting
Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave…
SecurityTrail of Bits8k
Code Improver
Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent…
SecurityTrail of Bits8k
Code Maturity Assessor
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity…
SecurityTrail of Bits8k
Codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql…
SecurityTrail of Bits8k
Constant Time Analysis
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or…
SecurityTrail of Bits8k
Constant Time Testing
Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the…
SecurityTrail of Bits8k
Cosmos Vulnerability Scanner
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3…
SecurityTrail of Bits8k
Coverage Analysis
Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage…
SecurityTrail of Bits8k
Crypto Protocol Diagram
Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid…
SecurityTrail of Bits8k
Devcontainer Setup
Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up…
SecurityTrail of Bits8k
Diagramming Code
Generates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack…
SecurityTrail of Bits8k
Differential Review
Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers…
SecurityTrail of Bits8k
Dimensional Analysis
Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit…
SecurityTrail of Bits8k
Dwarf Expert
Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf…
SecurityTrail of Bits8k
Entry Point Analyzer
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by…
SecurityTrail of Bits8k
Firebase Apk Scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK…
SecurityTrail of Bits8k
Fp Check
Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked…
SecurityTrail of Bits8k
Fuzzing Dictionary
Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries…
SecurityTrail of Bits8k
Fuzzing Obstacles
Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state…
SecurityTrail of Bits8k
Genotoxic
Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call…
SecurityTrail of Bits8k
GH CLI
Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
SecurityTrail of Bits8k
Github Triage
Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and…
SecurityTrail of Bits8k
Goal Prompt
Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal…
SecurityTrail of Bits8k
Graph Evolution
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths…
SecurityTrail of Bits8k
Guidelines Advisor
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability…
SecurityTrail of Bits8k
Harness Writing
Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes…
SecurityTrail of Bits8k
Hunt Regressions
Use when discovering possible regressions from a pinned change and its callers before reproduction.
SecurityTrail of Bits8k
Implement Patch
Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.
SecurityTrail of Bits8k
Interpreting Culture Index
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis…
SecurityTrail of Bits8k
Let Fate Decide
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps…
SecurityTrail of Bits8k
Libafl
Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer for targets the…
SecurityTrail of Bits8k
Libfuzzer
Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and…
SecurityTrail of Bits8k
Mermaid To Proverif
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally…
SecurityTrail of Bits8k
Modern Cpp
Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with…
SecurityTrail of Bits8k
Modern Python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
SecurityTrail of Bits8k
Mutation Testing
Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results…
SecurityTrail of Bits8k
Open Sourcing
This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness"…
SecurityTrail of Bits8k
Ossfuzz
Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper…
SecurityTrail of Bits8k
Patching Bugs
Use when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.
SecurityTrail of Bits8k
Post Patch Validation
Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly…
SecurityTrail of Bits8k
PR Improver
Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched…
SecurityTrail of Bits8k
Prepare Regression
Use when pinning before/after sources and collecting PR or commit context for a regression investigation.
SecurityTrail of Bits8k
Property Based Testing
Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a…
SecurityTrail of Bits8k
Prove Patch
Use when a local security patch commit needs independent scoped and three-arm proof.
SecurityTrail of Bits8k
Regression Hunt
Use when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.
SecurityTrail of Bits8k
Replay Regression
Use when independently verifying a supplied PoC against fresh live before/after deployments.
SecurityTrail of Bits8k
Report Regressions
Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
SecurityTrail of Bits8k
Reproduce Bug
Use when a named runtime or compiler bug in a local repository needs independent reproduction.
SecurityTrail of Bits8k
Reproduce Regression
Use when deploying before/after systems and building a live-system PoC for a regression candidate.
SecurityTrail of Bits8k
Review Walkthrough
Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.
SecurityTrail of Bits8k
Rust Review
Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime…
SecurityTrail of Bits8k
Ruzzy
Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C…
SecurityTrail of Bits8k
Sarif Parsing
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings"…
SecurityTrail of Bits8k
Second Opinion
Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on…
SecurityTrail of Bits8k
Secure Workflow Guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual…
SecurityTrail of Bits8k
Semgrep
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through…
SecurityTrail of Bits8k
Semgrep Rule Creator
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
SecurityTrail of Bits8k
Semgrep Rule Variant Creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces…
SecurityTrail of Bits8k
Sharp Edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic…
SecurityTrail of Bits8k
Skill Improver
Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop…
SecurityTrail of Bits8k
Slicing Code Context
Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function…
SecurityTrail of Bits8k
Solana Vulnerability Scanner
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing…
SecurityTrail of Bits8k
Spec To Code Compliance
Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions…
SecurityTrail of Bits8k
Substrate Vulnerability Scanner
Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate…
SecurityTrail of Bits8k
Supply Chain Risk Auditor
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm…
SecurityTrail of Bits8k
Testing Handbook Generator
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type…
SecurityTrail of Bits8k
Token Integration Analyzer
Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird…
SecurityTrail of Bits8k
Ton Vulnerability Scanner
Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use…
SecurityTrail of Bits8k
Trailmark
Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries…
SecurityTrail of Bits8k
Trailmark Finding Triage
Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint…
SecurityTrail of Bits8k
Trailmark Review Gate
Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or…
SecurityTrail of Bits8k
Trailmark Structural
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and…
SecurityTrail of Bits8k
Trailmark Summary
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural…
SecurityTrail of Bits8k
Trailmark Variant Neighborhood
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common…
SecurityTrail of Bits8k
Validate Bug
Use when a bug PoC package needs an independent rerun and judgment before patching.
SecurityTrail of Bits8k
Variant Analysis
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up…
SecurityTrail of Bits8k
Vector Forge
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test…
SecurityTrail of Bits8k
Vulnerability Triage Brocards
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a…
SecurityTrail of Bits8k
Writing Lean Proofs
Writes and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications…
SecurityTrail of Bits8k
Wycheproof
Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading…
SecurityTrail of Bits8k
Yara Rule Authoring
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string…
SecurityTrail of Bits8k
Zeroize Audit
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow…
SecurityTrail of Bits8k