trailofbits

Systematic false positive verification for security bug analysis with mandatory gate reviews

Generate minimal macOS Seatbelt sandbox configurations for applications

Audit supply-chain threat landscape of project dependencies for exploitation or takeover risk

Draws Tarot cards using cryptographic randomness to add entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous.

Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)

Automatically reviews and fixes Claude Code skills through iterative refinement until they meet quality standards. Requires plugin-dev plugin.

Teaches design patterns for workflow-based Claude Code skills and provides a review agent for auditing existing skills

Diagnose and fix Claude in Chrome MCP extension connectivity issues

Debug Buttercup Kubernetes deployments

Create pre-configured devcontainers with Claude Code and language-specific tooling

Intercepts GitHub URL fetches and curl/wget commands, redirecting to the authenticated gh CLI.

Runs code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles Codex's built-in MCP server for direct tool access.

Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.

YARA-X detection rule authoring with linting and quality analysis

Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production

Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.

Clarify ambiguous requirements by asking questions before implementing. Only when invoked explicitly.

Build deep architectural context through ultra-granular code analysis before vulnerability hunting

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

Search and extract data from Burp Suite project files (.burp) for security analysis

Detect compiler-induced timing side-channels in cryptographic code

Interprets Culture Index survey results for individuals and teams

Security-focused differential review of code changes with git history analysis and blast radius estimation

Interact with and understand the DWARF debugging format

Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

Verify fix commits address audit findings without introducing bugs

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

Property-based testing guidance for multiple languages and smart contracts

Create custom Semgrep rules for detecting bug patterns and security vulnerabilities

Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation

Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

Specification-to-code compliance checker for blockchain audits with evidence-based alignment analysis

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

Find similar vulnerabilities and bugs across codebases using pattern-based analysis