New Checked the same way as MCP servers

Agent Skills, and what they let an agent do

Read straight from each publisher's repository. For every skill: what it allows the agent to do, the scripts it ships, and what fixed checks matched. Nothing is run.

Skills from Trail of Bits97

Clear filters

mutation-testingTrail of BitsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.Runs commandsEdits files
open-sourcingTrail of Bits · 2 scriptsThis skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a pub…Runs commands
ossfuzzTrail of BitsEnrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when se…Reaches the network
panel-reviewTrail of BitsReviews a code target by launching a panel of specialist auditor agents and merging their reports. Use when asked to run a panel review.Instructions only
patching-bugsTrail of BitsUse when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.Instructions only
post-patch-validationTrail of Bits · 1 scriptValidates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging,…Runs commandsEdits files
pr-improverTrail of BitsRuns an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolki…Runs commands
prepare-regressionTrail of BitsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.Instructions only
property-based-testingTrail of BitsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and …Instructions only
prove-patchTrail of BitsUse when a local security patch commit needs independent scoped and three-arm proof.Instructions only
regression-huntTrail of BitsUse when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.Instructions only
replay-regressionTrail of BitsUse when independently verifying a supplied PoC against fresh live before/after deployments.Instructions only
report-regressionsTrail of BitsUse when assembling or refreshing an evidence-linked regression report from saved campaign decisions.Instructions only
reproduce-bugTrail of BitsUse when a named runtime or compiler bug in a local repository needs independent reproduction.Instructions only
reproduce-regressionTrail of BitsUse when deploying before/after systems and building a live-system PoC for a regression candidate.Instructions only
review-prTrail of BitsReviews the current branch's changes against its base branch as a pull request: correctness of new and modified code, test coverage for it, and documentation accuracy. Use when asked to review a branch, a diff, or a pull request.Runs commands
review-walkthroughTrail of Bits · 1 scriptGenerates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.Runs commands
rust-reviewTrail of BitsPerforms comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly th…Runs commandsEdits files
ruzzyTrail of BitsSets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem…Instructions only
sarif-parsingTrail of Bits · 2 scriptsParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format…Reaches the networkRuns commands
second-opinionTrail of BitsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.Runs commands
secure-workflow-guideTrail of BitsGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, a…Instructions only
semgrepTrail of Bits · 3 scriptsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the…Destructive commandsReaches the networkRuns commands1 high finding
semgrep-rule-creatorTrail of BitsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.Reaches the networkRuns commandsEdits files
semgrep-rule-variant-creatorTrail of BitsCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.Reaches the networkRuns commandsEdits files
sharp-edgesTrail of BitsIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit o…Instructions only
skill-improverTrail of BitsRuns an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-…Runs commands
slicing-code-contextTrail of Bits · 2 scriptsSelects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to const…Runs commands
solana-vulnerability-scannerTrail of BitsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.Instructions only1 high finding
spec-to-code-complianceTrail of BitsCheck code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or desig…Instructions only
substrate-vulnerability-scannerTrail of BitsScans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.Instructions only1 high finding
supply-chain-risk-auditorTrail of Bits · 8 scriptsAudits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit depen…Reaches the networkRuns commandsEdits files
testing-handbook-generatorTrail of BitsGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the us…Instructions only
token-integration-analyzerTrail of BitsToken integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-…Instructions only
ton-vulnerability-scannerTrail of BitsScans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.Instructions only1 high finding
trailmarkTrail of BitsBuilds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, stru…Instructions only
trailmark-finding-triageTrail of Bits · 2 scriptsPerforms graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evide…Runs commandsEdits files1 finding
trailmark-review-gateTrail of BitsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity g…Runs commandsEdits files
trailmark-structuralTrail of BitsRuns full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/refer…Runs commands
trailmark-summaryTrail of BitsRuns a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.Runs commands
trailmark-variant-neighborhoodTrail of BitsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationsh…Runs commandsEdits files
validate-bugTrail of BitsUse when a bug PoC package needs an independent rerun and judgment before patching.Instructions only
variant-analysisTrail of BitsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the b…Instructions only
vector-forgeTrail of BitsMutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/afte…Instructions only
vulnerability-triage-brocardsTrail of BitsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a…Instructions only
writing-lean-proofsTrail of BitsWrites and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications in Lean 4, defining new types or definitions in a Lean library, reviewing Lean pr…Instructions only
wycheproofTrail of BitsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading …Instructions only
yara-rule-authoringTrail of Bits · 5 scriptsGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive red…Destructive commandsReaches the networkRuns commands1 high finding

Labels come from the skill's own files, read on the date shown: the tools its frontmatter allows and the scripts it ships. They are not a safety rating, and no finding is not a safety guarantee. How skills are checked.