trailofbits
84 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.
trailofbitssharp-edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.
- installations
- 3
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsc-review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitscoverage-analysis
Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsdifferential-review
Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.
- installations
- 2
- GitHub Stars
- 7,3 k
- Mis à jour
- 28 sept.
trailofbitsentry-point-analyzer
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or p
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsfirebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsgh-cli
Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsmutation-testing
Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsopen-sourcing
This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public", "check open-source readiness", "choose a license for this project", or "set up release automation" ahead of a public launch. Provides a release-readiness workflow covering secrets hygiene, licensing, documentation, CI, and language-specific packaging.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 22 oct.
trailofbitsreproduce-bug
Use when a named runtime or compiler bug in a local repository needs independent reproduction.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 22 oct.
trailofbitssecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract se
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.
trailofbitsspec-to-code-compliance
Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.
- installations
- 2
- GitHub Stars
- 7,7 k
- Mis à jour
- 23 oct.