New Checked the same way as MCP servers
Agent Skills, and what they let an agent do
Read straight from each publisher's repository. For every skill: what it allows the agent to do, the scripts it ships, and what fixed checks matched. Nothing is run.
Skills from Trail of Bits16
Clear filters- aflppTrail of BitsSets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing acr…Reaches the network
- atherisTrail of BitsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hu…Destructive commandsReaches the network1 finding
- burpsuite-project-parserTrail of Bits · 1 scriptSearches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a…Reaches the networkRuns commands
- devcontainer-setupTrail of Bits · 2 scriptsCreates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Claude Code workspaces.Destructive commandsReaches the networkRuns commands2 high findings
- dwarf-expertTrail of BitsAnalyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, …Reaches the networkRuns commandsEdits files
- firebase-apk-scannerTrail of Bits · 1 scriptScans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testi…Destructive commandsReaches the networkRuns commands1 high finding
- interpreting-culture-indexTrail of Bits · 7 scriptsInterprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, inter…Reaches the networkRuns commandsEdits files3 high findings
- libaflTrail of BitsBuilds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer for targets the standard tools do not fit. Use when writing a bespoke fuzzer or mutator, fuzzing a non…Reaches the network1 high finding
- libfuzzerTrail of BitsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing o…Reaches the network
- ossfuzzTrail of BitsEnrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when se…Reaches the network
- sarif-parsingTrail of Bits · 2 scriptsParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format…Reaches the networkRuns commands
- semgrepTrail of Bits · 3 scriptsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the…Destructive commandsReaches the networkRuns commands1 high finding
- semgrep-rule-creatorTrail of BitsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.Reaches the networkRuns commandsEdits files
- semgrep-rule-variant-creatorTrail of BitsCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.Reaches the networkRuns commandsEdits files
- supply-chain-risk-auditorTrail of Bits · 8 scriptsAudits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit depen…Reaches the networkRuns commandsEdits files
- yara-rule-authoringTrail of Bits · 5 scriptsGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive red…Destructive commandsReaches the networkRuns commands1 high finding
Labels come from the skill's own files, read on the date shown: the tools its frontmatter allows and the scripts it ships. They are not a safety rating, and no finding is not a safety guarantee. How skills are checked.