New Checked the same way as MCP servers
Agent Skills, and what they let an agent do
Read straight from each publisher's repository. For every skill: what it allows the agent to do, the scripts it ships, and what fixed checks matched. Nothing is run.
Skills from Trail of Bits49
Clear filters- address-sanitizerTrail of BitsBuilds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade…Instructions only
- adjudicate-regressionTrail of BitsUse when deciding whether source and live reproduction evidence establish a new regression or an exclusion.Instructions only
- algorand-vulnerability-scannerTrail of BitsScans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).Instructions only1 high finding
- audit-augmentationTrail of BitsAugments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-b…Instructions only
- audit-context-buildingTrail of BitsUnderstand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pa…Instructions only
- audit-prep-assistantTrail of BitsPrepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments…Instructions only
- cairo-vulnerability-scannerTrail of BitsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.Instructions only1 high finding
- cargo-fuzzTrail of BitsSets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-derived structured inputs, sanitizer options, cargo fuzz coverage, and reproducin…Instructions only
- code-maturity-assessorTrail of BitsSystematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a sc…Instructions only
- constant-time-testingTrail of BitsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result.…Instructions only
- cosmos-vulnerability-scannerTrail of BitsScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or a…Instructions only
- coverage-analysisTrail of BitsMeasures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use whe…Instructions only
- entry-point-analyzerTrail of BitsAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured…Instructions only
- fuzzing-dictionaryTrail of BitsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use …Instructions only
- fuzzing-obstaclesTrail of BitsPatches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and…Instructions only
- genotoxicTrail of BitsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. …Instructions only
- gh-cliTrail of BitsEnforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.Instructions only
- guidelines-advisorTrail of BitsSmart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, an…Instructions only
- harness-writingTrail of BitsDesigns and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, and deciding what to fuzz together. Use when writing a first LLVMFuzzerTestOneInput…Instructions only
- hunt-regressionsTrail of BitsUse when discovering possible regressions from a pinned change and its callers before reproduction.Instructions only
- implement-patchTrail of BitsUse when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.Instructions only
- modern-cppTrail of BitsGuides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::…Instructions only
- modern-pythonTrail of BitsConfigures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.Instructions only
- panel-reviewTrail of BitsReviews a code target by launching a panel of specialist auditor agents and merging their reports. Use when asked to run a panel review.Instructions only
- patching-bugsTrail of BitsUse when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.Instructions only
- prepare-regressionTrail of BitsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.Instructions only
- property-based-testingTrail of BitsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and …Instructions only
- prove-patchTrail of BitsUse when a local security patch commit needs independent scoped and three-arm proof.Instructions only
- regression-huntTrail of BitsUse when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.Instructions only
- replay-regressionTrail of BitsUse when independently verifying a supplied PoC against fresh live before/after deployments.Instructions only
- report-regressionsTrail of BitsUse when assembling or refreshing an evidence-linked regression report from saved campaign decisions.Instructions only
- reproduce-bugTrail of BitsUse when a named runtime or compiler bug in a local repository needs independent reproduction.Instructions only
- reproduce-regressionTrail of BitsUse when deploying before/after systems and building a live-system PoC for a regression candidate.Instructions only
- ruzzyTrail of BitsSets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem…Instructions only
- secure-workflow-guideTrail of BitsGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, a…Instructions only
- sharp-edgesTrail of BitsIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit o…Instructions only
- solana-vulnerability-scannerTrail of BitsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.Instructions only1 high finding
- spec-to-code-complianceTrail of BitsCheck code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or desig…Instructions only
- substrate-vulnerability-scannerTrail of BitsScans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.Instructions only1 high finding
- testing-handbook-generatorTrail of BitsGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the us…Instructions only
- token-integration-analyzerTrail of BitsToken integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-…Instructions only
- ton-vulnerability-scannerTrail of BitsScans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.Instructions only1 high finding
- trailmarkTrail of BitsBuilds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, stru…Instructions only
- validate-bugTrail of BitsUse when a bug PoC package needs an independent rerun and judgment before patching.Instructions only
- variant-analysisTrail of BitsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the b…Instructions only
- vector-forgeTrail of BitsMutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/afte…Instructions only
- vulnerability-triage-brocardsTrail of BitsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a…Instructions only
- writing-lean-proofsTrail of BitsWrites and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications in Lean 4, defining new types or definitions in a Lean library, reviewing Lean pr…Instructions only
Labels come from the skill's own files, read on the date shown: the tools its frontmatter allows and the scripts it ships. They are not a safety rating, and no finding is not a safety guarantee. How skills are checked.