@trailofbits

coverage-analysis establishes baseline metrics and identifies fuzzing blockers by instrumenting code and analyzing execution paths across corpora. provides toolchain-specific workflows for llvm, gcc, rust, and major fuzzers.

sharp-edges identifies api and configuration designs that enable developer misuse by analyzing algorithm selection footguns, dangerous defaults, type confusion, and silent failures. applies systematic threat modeling across three adversary personas.

seatbelt-sandboxer generates minimal allowlist-based macOS sandbox profiles for restricting application file, network, and process access. covers profiling methodology, iterative testing, syntax reference, and failure mode diagnosis.

substrate-vulnerability-scanner systematically detects 7 critical vulnerability patterns in Substrate/FRAME pallets including arithmetic overflow, panic dos, weight miscalculation, and origin validation failures. targets auditors reviewing custom runtime code before chain launch.

sarif-parsing provides comprehensive strategies for extracting, aggregating, and deduplicating static analysis findings using jq, python libraries, and fingerprinting techniques. covers path normalization, schema validation, and ci/cd integration patterns.

solana-vulnerability-scanner audits native and anchor solana programs for 6 critical vulnerability patterns including arbitrary cpi, improper pda validation, missing signer and ownership checks, sysvar spoofing, and instruction introspection flaws. includes detection patterns, remediation code, and testing strategies.

mermaid-to-proverif translates cryptographic protocol diagrams into formal verification models, covering participant extraction, cryptographic operation mapping, type/function declaration, event instrumentation, security query formulation, process construction, and validation against the dolev-yao model.

semgrep-rule-variant-creator ports existing semgrep rules to new languages through mandatory applicability analysis, test-first validation, ast-aware rule translation, and per-language independent cycles. enforces strict test passage before output.

wycheproof provides curated test vectors for validating cryptographic implementations against known attacks and edge cases. covers symmetric encryption, signatures, key exchange, and hashing across multiple curves and algorithms with concrete python and javascript harness examples.

genotoxic triages mutation testing and necessist findings into false positives, missing tests, and fuzzing targets using code graph analysis. combines two testing signals to identify high-confidence test gaps and expose weak assertions.

codeql performs interprocedural security vulnerability scanning across eight languages using data flow analysis, database quality checks, and custom query suites to avoid silent result filtering.

spec-to-code-compliance audits blockchain implementations against formal specifications across logic, invariants, flows, and security guarantees. performs line-by-line semantic analysis, generates structured intermediate representations, and produces divergence findings with severity classification.

audit-context-building establishes a structured, line-by-line code analysis discipline for building stable architectural understanding before vulnerability discovery, using first-principles reasoning and explicit invariant tracking across function and module boundaries.

harness-writing covers fuzzing harness design across c/c++, rust, go, and python with entry point patterns, input parsing strategies, and tool-specific implementations for libfuzzer, afl++, cargo-fuzz, and go-fuzz.

semgrep runs parallel static analysis with automatic language detection, pro cross-file taint tracking fallback to oss mode, and merged sarif output. requires explicit user approval before execution.

supply-chain-risk-auditor evaluates project dependencies against six specific risk criteria (single maintainer, unmaintained status, low popularity, high-risk features, past cves, absent security contact) and generates a structured report with flagged dependencies and suggested alternatives.

fp-check systematically verifies suspected security bugs through structured claim analysis, data flow tracing, and evidence-based verdicts. covers standard and deep verification paths with explicit rejection criteria and false positive pattern detection.

token-integration-analyzer systematically identifies token security risks across erc20/erc721 implementations and integrations using trail of bits methodology, detects 24+ non-standard token behaviors, and delivers prioritized remediation guidance with defensive transfer patterns.

constant-time-analysis detects timing side-channel vulnerabilities in cryptographic implementations by analyzing assembly and bytecode for variable-time operations like division, branching, and table lookups on secret data.

skill-improver automates iterative quality checks on claude code skills via the skill-reviewer agent, categorizing issues by severity and guiding fix-verify cycles until standards are met.

ton-vulnerability-scanner identifies three security patterns in ton smart contracts (integer-as-boolean misuse, fake jetton handlers, unsafe gas forwarding). detects funC code via file extensions and project structure, then surfaces vulnerable code with pocs and fix recommendations.

guidelines-advisor audits smart contract codebases against trail of bits security practices, generating documentation, architecture analysis, and prioritized remediation across 11 assessment areas with file-level specificity.

meta-skill for generating security testing skills from the trail of bits handbook via two-pass content generation and cross-reference population, with detailed phase workflows and template application rules.

property-based-testing guides developers to apply generative test strategies across serialization, parsing, validation, smart contracts and mathematical code. detection triggers identify high-value candidates for stronger coverage than example tests.

agentic-actions-auditor provides conceptual framing for auditing github actions workflows that invoke ai coding agents, but omits concrete procedural steps and concrete examples of detected vulnerabilities.

dwarf-expert covers the dwarf debug format standard (v3-v5) including file parsing, standard questions, and code interaction. scope is deliberately bounded away from compilers, runtime debugging, and reverse engineering tools.

secure-workflow-guide covers smart contract security through slither scanning, architectural diagram generation, property documentation, and manual review guidance aligned with trail of bits' methodology.

second-opinion delegates code review to external llm cli tools (openai codex or google gemini) on git diffs and uncommitted changes. useful for cross-model validation and specific review angles before pr submission.

audit-augmentation overlays SARIF and weAudit findings onto Trailmark code graphs, enabling cross-referencing of static analysis results with code structure and blast radius data.

fuzzing-obstacles documents conditional compilation patterns to disable checksums, global state dependencies, and validation barriers in code under test, enabling deeper fuzzer coverage without altering production builds.

yara-rule-authoring teaches principled authoring of yara-x detection rules with emphasis on atom quality, specificity, and false positive avoidance. covers naming conventions, syntax patterns, validation strategies, and common pitfalls when targeting specific malware families.

trailmark builds directed graphs of source code structure (functions, classes, calls, metadata) for security analysis, audit prep, and attack surface mapping across multiple languages.

code-maturity-assessor applies trail of bits' 9-category framework to evaluate blockchain codebases, mapping security posture against arithmetic safety, auditing, access controls, and other engineering dimensions. output is a scored maturity card with improvement roadmap.

firebase-apk-scanner extracts firebase configuration from decompiled android apks and tests realtime databases, firestore, storage, and cloud functions for unauthenticated access, with fallback curl procedures for failed automated scans.

libfuzzer provides in-process coverage-guided fuzzing for c/c++ projects via llvm integration. maintenance-only since late 2022 but remains the simplest entry point for single-core fuzzing workflows.

mutation-testing provides trigger patterns and scope bounds for configuring mewt/muton campaigns across multiple languages, but lacks substantive procedural steps, failure handling, or concrete workflow examples.

insecure-defaults identifies configuration vulnerabilities where applications default to weak or missing secrets rather than failing safely. detects fail-open patterns in env variable handling and hardcoded credentials across audit and deployment contexts.

aflpp enables multi-core fuzzing campaigns for c/c++ codebases using diverse mutation strategies, positioned as a mature alternative to libfuzzer for throughput-constrained projects.

cosmos-vulnerability-scanner audits cosmos sdk modules and cosmwasm contracts against consensus-critical failures (chain halts, fund loss, state divergence). supports go and rust with parallel specialised agents and structured remediation output.

constant-time-testing documents timing side-channel vulnerabilities in cryptographic implementations and establishes why they matter, but lacks actionable steps, concrete trigger scenarios, and failure-mode guidance.

gh-cli redirects github-bound workflows from curl/fetch to authenticated gh command patterns. covers repos, prs, issues, and releases but lacks implementation detail.

entry-point-analyzer documents a workflow for identifying state-changing external functions in smart contracts during security audits. the skill lacks actionable steps, specific detection methods, or guidance on edge cases like proxy patterns or delegatecall risks.

ossfuzz documents the infrastructure and configuration needed for continuous fuzzing enrollment, covering base images, harness building, and project metadata, but lacks actionable enrollment procedures.

graph-evolution builds code graphs at two snapshots and surfaces structural diffs, capturing security-relevant changes like attack paths and taint shifts that text diffs miss.

let-fate-decide uses tarot card draws to introduce structured randomness into ambiguous planning decisions. interprets spreads via the 12 houses of the zodiac framework but lacks automation integration and decision-mapping logic.

diagramming-code converts code graph metadata into mermaid diagrams. claude selects diagram types and parameters while delegating syntax generation to a pre-made script. five use cases documented, none explicitly excluded.

dimensional-analysis provides a workflow controller for unit and dimension tracking across numeric codebases, delegating annotation and validation to subagents. intended for defi, financial, and scientific code audits where unit mismatches cause bugs.

c-review orchestrates multi-agent security analysis of c/c++ code for memory corruption and platform vulnerabilities via worker subagents and deduplication/false-positive filtering, but lacks concrete step-by-step procedure and decision logic.

address-sanitizer documents memory error detection via compile-time instrumentation and shadow memory tracking, but lacks actionable procedure, trigger conditions, and failure mode coverage.

atheris is a coverage-guided fuzzer for python code and c extensions, providing memory corruption detection via integrated AddressSanitizer support, but lacks actionable setup and execution guidance.

ruzzy is a coverage-guided fuzzer for ruby built on libfuzzer, supporting pure ruby code and c extensions with sanitizer integration for memory corruption detection.

Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting…

Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a…

LibAFL is a modular fuzzing library for building custom fuzzers. Use for advanced fuzzing needs, custom mutators, or non-standard fuzzing targets.

Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition…

Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems,…

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access…

Fuzzing dictionaries guide fuzzers with domain-specific tokens. Use when fuzzing parsers, protocols, or format-specific code.

cargo-fuzz is the de facto fuzzing tool for Rust projects using Cargo. Use for fuzzing Rust code with libFuzzer backend.

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes…

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static…

Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or…

Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context,…

Clarify requirements before implementing. Use when serious doubts arise.

Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

Guides the design and structuring of workflow-based Claude Code skills with multi-step phases, decision trees, subagent delegation, and progressive disclosure.…

Debugs the Buttercup CRS (Cyber Reasoning System) running on Kubernetes. Use when diagnosing pod crashes, restart loops, Redis failures, resource pressure,…

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and…

Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected",…

Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then…

Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack…

Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs…

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates…

>