Agent Skills: what each one lets an agent do

test-masterJeff AllanGenerates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, o…Instructions only

the-foolJeff AllanUse when challenging ideas, plans, decisions, or proposals using structured critical reasoning. Invoke to play devil's advocate, run a pre-mortem, red team, or audit evidence and assumptions.Instructions only

typescript-proJeff AllanImplements advanced TypeScript type systems, creates custom type guards, utility types, and branded types, and configures tRPC for end-to-end type safety. Use when building TypeScript applications requiring advanced generics, conditional or mapped types, discr…Instructions only

vue-expertJeff AllanBuilds Vue 3 components with Composition API patterns, configures Nuxt 3 SSR/SSG projects, sets up Pinia stores, scaffolds Quasar/Capacitor mobile apps, implements PWA features, and optimises Vite builds. Use when creating Vue 3 applications with Composition A…Instructions only

vue-expert-jsJeff AllanCreates Vue 3 components, builds vanilla JS composables, configures Vite projects, and sets up routing and state management using JavaScript only — no TypeScript. Generates JSDoc-typed code with @typedef, @param, and @returns annotations for full type coverage…Instructions only

websocket-engineerJeff AllanUse when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.Instructions only

wordpress-proJeff AllanDevelops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and…Instructions only

address-sanitizerTrail of BitsBuilds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade…Instructions only

adjudicate-regressionTrail of BitsUse when deciding whether source and live reproduction evidence establish a new regression or an exclusion.Instructions only

algorand-vulnerability-scannerTrail of BitsScans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).Instructions only1 high finding

audit-augmentationTrail of BitsAugments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-b…Instructions only

audit-context-buildingTrail of BitsUnderstand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pa…Instructions only

audit-prep-assistantTrail of BitsPrepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments…Instructions only

cairo-vulnerability-scannerTrail of BitsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.Instructions only1 high finding

cargo-fuzzTrail of BitsSets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-derived structured inputs, sanitizer options, cargo fuzz coverage, and reproducin…Instructions only

code-maturity-assessorTrail of BitsSystematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a sc…Instructions only

constant-time-testingTrail of BitsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result.…Instructions only

cosmos-vulnerability-scannerTrail of BitsScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or a…Instructions only

coverage-analysisTrail of BitsMeasures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use whe…Instructions only

entry-point-analyzerTrail of BitsAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured…Instructions only

fuzzing-dictionaryTrail of BitsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use …Instructions only

fuzzing-obstaclesTrail of BitsPatches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and…Instructions only

genotoxicTrail of BitsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. …Instructions only

gh-cliTrail of BitsEnforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.Instructions only

guidelines-advisorTrail of BitsSmart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, an…Instructions only

harness-writingTrail of BitsDesigns and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, and deciding what to fuzz together. Use when writing a first LLVMFuzzerTestOneInput…Instructions only

hunt-regressionsTrail of BitsUse when discovering possible regressions from a pinned change and its callers before reproduction.Instructions only

implement-patchTrail of BitsUse when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.Instructions only

modern-cppTrail of BitsGuides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::…Instructions only

modern-pythonTrail of BitsConfigures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.Instructions only

panel-reviewTrail of BitsReviews a code target by launching a panel of specialist auditor agents and merging their reports. Use when asked to run a panel review.Instructions only

patching-bugsTrail of BitsUse when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.Instructions only

prepare-regressionTrail of BitsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.Instructions only

property-based-testingTrail of BitsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and …Instructions only

prove-patchTrail of BitsUse when a local security patch commit needs independent scoped and three-arm proof.Instructions only

regression-huntTrail of BitsUse when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.Instructions only

replay-regressionTrail of BitsUse when independently verifying a supplied PoC against fresh live before/after deployments.Instructions only

report-regressionsTrail of BitsUse when assembling or refreshing an evidence-linked regression report from saved campaign decisions.Instructions only

reproduce-bugTrail of BitsUse when a named runtime or compiler bug in a local repository needs independent reproduction.Instructions only

reproduce-regressionTrail of BitsUse when deploying before/after systems and building a live-system PoC for a regression candidate.Instructions only

Agent Skills

1,653 skills match