New Checked the same way as MCP servers
Agent Skills, and what they let an agent do
Read straight from each publisher's repository. For every skill: what it allows the agent to do, the scripts it ships, and what fixed checks matched. Nothing is run.
Skills from Trail of Bits41
Clear filters- agentic-actions-auditorTrail of BitsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pip…Runs commands
- burpsuite-project-parserTrail of Bits · 1 scriptSearches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a…Reaches the networkRuns commands
- c-reviewTrail of BitsPerforms comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer over…Runs commands
- code-improverTrail of BitsRuns an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guar…Runs commands
- codeqlTrail of Bits · 15 scriptsScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities i…Runs commandsEdits files
- constant-time-analysisTrail of BitsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#,…Runs commands
- crypto-protocol-diagramTrail of Bits · 1 scriptExtracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visual…Runs commands1 high finding
- devcontainer-setupTrail of Bits · 2 scriptsCreates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Claude Code workspaces.Destructive commandsReaches the networkRuns commands2 high findings
- diagramming-codeTrail of Bits · 2 scriptsGenerates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack surface data flow visualizations. Use when visualizing code architecture, drawing call…Runs commands
- differential-reviewTrail of BitsPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when rev…Runs commandsEdits files
- dwarf-expertTrail of BitsAnalyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, …Reaches the networkRuns commandsEdits files
- firebase-apk-scannerTrail of Bits · 1 scriptScans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testi…Destructive commandsReaches the networkRuns commands1 high finding
- fp-checkTrail of BitsSystematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to veri…Runs commandsEdits files
- github-triageTrail of BitsTriages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintainer-approved ones, and spawning review subagents for never-reviewed ones — then clo…Runs commandsEdits files
- goal-promptTrail of Bits · 2 scriptsDrafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal prompt, goal condition, /goal command, goal-mode objective, or copy-ready long-runni…Runs commandsEdits files
- graph-evolutionTrail of Bits · 1 scriptCompares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary…Runs commands
- interpreting-culture-indexTrail of Bits · 7 scriptsInterprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, inter…Reaches the networkRuns commandsEdits files3 high findings
- let-fate-decideTrail of Bits · 2 scriptsDraws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other no…Runs commands
- mermaid-to-proverifTrail of Bits · 1 scriptTranslates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol secur…Runs commands
- mutation-testingTrail of BitsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.Runs commandsEdits files
- open-sourcingTrail of Bits · 2 scriptsThis skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a pub…Runs commands
- post-patch-validationTrail of Bits · 1 scriptValidates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging,…Runs commandsEdits files
- pr-improverTrail of BitsRuns an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolki…Runs commands
- review-prTrail of BitsReviews the current branch's changes against its base branch as a pull request: correctness of new and modified code, test coverage for it, and documentation accuracy. Use when asked to review a branch, a diff, or a pull request.Runs commands
- review-walkthroughTrail of Bits · 1 scriptGenerates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.Runs commands
- rust-reviewTrail of BitsPerforms comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly th…Runs commandsEdits files
- sarif-parsingTrail of Bits · 2 scriptsParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format…Reaches the networkRuns commands
- second-opinionTrail of BitsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.Runs commands
- semgrepTrail of Bits · 3 scriptsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the…Destructive commandsReaches the networkRuns commands1 high finding
- semgrep-rule-creatorTrail of BitsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.Reaches the networkRuns commandsEdits files
- semgrep-rule-variant-creatorTrail of BitsCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.Reaches the networkRuns commandsEdits files
- skill-improverTrail of BitsRuns an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-…Runs commands
- slicing-code-contextTrail of Bits · 2 scriptsSelects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to const…Runs commands
- supply-chain-risk-auditorTrail of Bits · 8 scriptsAudits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit depen…Reaches the networkRuns commandsEdits files
- trailmark-finding-triageTrail of Bits · 2 scriptsPerforms graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evide…Runs commandsEdits files1 finding
- trailmark-review-gateTrail of BitsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity g…Runs commandsEdits files
- trailmark-structuralTrail of BitsRuns full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/refer…Runs commands
- trailmark-summaryTrail of BitsRuns a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.Runs commands
- trailmark-variant-neighborhoodTrail of BitsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationsh…Runs commandsEdits files
- yara-rule-authoringTrail of Bits · 5 scriptsGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive red…Destructive commandsReaches the networkRuns commands1 high finding
- zeroize-auditTrail of Bits · 25 scriptsDetects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other…Destructive commandsRuns commandsEdits files5 high findings
Labels come from the skill's own files, read on the date shown: the tools its frontmatter allows and the scripts it ships. They are not a safety rating, and no finding is not a safety guarantee. How skills are checked.