StealIt
Trail of Bits OfficialClaude skill for security

Genotoxic

genotoxic

Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.

Install

Run this in your project folder. It works with Claude Code, Cursor, Codex and dozens of other agents.

$ npx skills add trailofbits/skills --skill genotoxic

Needs Node.js. Add -g to install for every project, or -a claude-code to skip the agent picker.

How to use Genotoxic

Once it's installed, Claude reads this skill on its own whenever a request matches what it's for, so you don't have to mention it by name. In Claude Code you can also run it directly by typing /genotoxic.

It contains no scripts, only instructions and reference files, so it can't run code on its own.

What the instructions cover

  1. 1When to Use
  2. 2When NOT to Use
  3. 3Prerequisites
  4. 4Rationalizations to Reject
  5. 5Quick Start
  6. 6Workflow Overview
  7. 7Decision Tree
  8. 8Phase 1: Build Code Graph and Run Pre-Analysis
  9. 9Phase 2: Run Mutation Testing
  10. 10Phase 2b: Run Necessist (Optional)
  11. 11Phase 3: Triage Findings
  12. 12Output Format

Section headings from the skill's SKILL.md file.

What's inside · 6 files

  • SKILL.md
  • agents/openai.yaml
  • assets/trail-of-bits-mark.svg
  • references/graph-analysis.md
  • references/mutation-frameworks.md
  • references/triage-methodology.md

More from Trail of Bits

See all →

Address Sanitizer

Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds…

SecurityTrail of Bits8k

Adjudicate Regression

Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.

SecurityTrail of Bits8k

Aflpp

Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns…

SecurityTrail of Bits8k

Agentic Actions Auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects…

SecurityTrail of Bits8k

More Claude skills for security

See all →

Attack Tree Construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

SecuritySeth Hobson42k

K8s Security Policies

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing…

SecuritySeth Hobson42k

Sast Configuration

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps…

SecuritySeth Hobson42k

Secrets Management

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets…

SecuritySeth Hobson42k