New Checked the same way as MCP servers
Agent Skills, and what they let an agent do
Read straight from each publisher's repository. For every skill: what it allows the agent to do, the scripts it ships, and what fixed checks matched. Nothing is run.
Skills from Trail of Bits18
Clear filters- codeqlTrail of Bits · 15 scriptsScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities i…Runs commandsEdits files
- differential-reviewTrail of BitsPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when rev…Runs commandsEdits files
- dimensional-analysisTrail of BitsAudits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit confusion, decimals or scaling mismatches, WAD/RAY scale errors, or the wrong tok…Edits files
- dwarf-expertTrail of BitsAnalyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, …Reaches the networkRuns commandsEdits files
- fp-checkTrail of BitsSystematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to veri…Runs commandsEdits files
- github-triageTrail of BitsTriages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintainer-approved ones, and spawning review subagents for never-reviewed ones — then clo…Runs commandsEdits files
- goal-promptTrail of Bits · 2 scriptsDrafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal prompt, goal condition, /goal command, goal-mode objective, or copy-ready long-runni…Runs commandsEdits files
- interpreting-culture-indexTrail of Bits · 7 scriptsInterprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, inter…Reaches the networkRuns commandsEdits files3 high findings
- mutation-testingTrail of BitsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.Runs commandsEdits files
- post-patch-validationTrail of Bits · 1 scriptValidates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging,…Runs commandsEdits files
- rust-reviewTrail of BitsPerforms comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly th…Runs commandsEdits files
- semgrep-rule-creatorTrail of BitsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.Reaches the networkRuns commandsEdits files
- semgrep-rule-variant-creatorTrail of BitsCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.Reaches the networkRuns commandsEdits files
- supply-chain-risk-auditorTrail of Bits · 8 scriptsAudits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit depen…Reaches the networkRuns commandsEdits files
- trailmark-finding-triageTrail of Bits · 2 scriptsPerforms graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evide…Runs commandsEdits files1 finding
- trailmark-review-gateTrail of BitsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity g…Runs commandsEdits files
- trailmark-variant-neighborhoodTrail of BitsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationsh…Runs commandsEdits files
- zeroize-auditTrail of Bits · 25 scriptsDetects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other…Destructive commandsRuns commandsEdits files5 high findings
Labels come from the skill's own files, read on the date shown: the tools its frontmatter allows and the scripts it ships. They are not a safety rating, and no finding is not a safety guarantee. How skills are checked.