This author has no editor-reviewed picks yet.
Community indexed社区索引
Indexed but not editor-reviewed; please audit before install.agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemi
audit context building
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug find…
testing handbook generator
Meta-skill that analyzes the Trail of Bits Testing Handbook (appsec.guide) and generates Claude Code skills for securit…
Domain Skill Template
Use this template for domain-specific security testing (cryptographic testing, web security methodologies, etc.).
constant time testing
Constant-time testing detects timing side channels in cryptographic code. Use when auditing crypto implementations for…
differential review
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase…
c review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-sp…
variant analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, bui…
firebase apk scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication is…
yara rule authoring
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or opt…
trailmark
Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radi…
semgrep rule creator
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing…
mermaid to proverif
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv fi…
semgrep
Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full rule…
sharp edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when revi…
insecure defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecure…
graph evolution
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-rel…
audit prep assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis too…
fp check
Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE…
dimensional analysis
Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when som…
entry point analyzer
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally cal…
constant time analysis
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, enco…
agentic actions auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gem…
codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Tri…
claude in chrome troubleshooting
Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, retu…
gh cli
Enforces authenticated gh CLI workflows over unauthenticated curl/WebFetch patterns. Use when working with GitHub URLs,…
spec to code compliance
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against wh…
supply chain risk auditor
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface,…
burpsuite project parser
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bo…
Designing a Workflow Skill
A 6-phase process for creating a workflow-based skill from scratch.
secure workflow guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradea…
designing workflow skills
Guides the design and structuring of workflow-based Claude Code skills with multi-step phases, decision trees, subagent…
gh-cli
Enforces authenticated gh CLI workflows over unauthenticated curl/WebFetch patterns. Use when working with GitHub URLs,