address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex.
algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
codeql — Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.
crypto-protocol-diagram — spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
diagramming-code — Generates Mermaid diagrams from Trailmark code graphs.
differential-review — Performs security-focused differential review of code changes.
dimensional-analysis — Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
entry-point-analyzer — Analyzes smart contract codebases to identify state-changing entry points for security auditing.
firebase-apk-scanner — Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.
fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.
github-triage — Triages a repository's open GitHub issues and pull requests via the gh CLI.
goal-prompt — Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex.
graph-evolution — Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes.
guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.
harness-writing — Designs and improves fuzzing harnesses for C/C++ and Rust.
interpreting-culture-index — Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data.
let-fate-decide — Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated.
libafl — Builds custom fuzzers with LibAFL, the modular Rust fuzzing library.
libfuzzer — Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
modern-python — Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
mutation-testing — Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps.
open-sourcing — This skill should be used when the user asks to "open source this project", "prepare this repository for public release", "make this repo public".
ossfuzz — Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
pr-improver — Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean.
property-based-testing — Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants.
review-walkthrough — Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
ruzzy — Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language.
sarif-parsing — Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.
second-opinion — Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits.
secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow.
semgrep-rule-creator — Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns.
semgrep-rule-variant-creator — Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages.
sharp-edges — Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes.
skill-improver — Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger.
slicing-code-context — Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
spec-to-code-compliance — Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent.
substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
supply-chain-risk-auditor — Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree.
testing-handbook-generator — md files with the structure each skill type requires. guide. Not for answering security testing questions — the generated skills cover those.
token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist.
ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts.
trailmark — Builds and queries multi-language source and binary code graphs for security analysis. toml`, and SQL schema graphs.
trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
trailmark-structural — 5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes.
trailmark-summary — Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list.
trailmark-variant-neighborhood — Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions.
variant-analysis — Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. ").
vector-forge — Mutation-driven test vector generation.
vulnerability-triage-brocards — This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission".
writing-lean-proofs — Writes and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions.
wycheproof — Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH.
yara-rule-authoring — Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules.
zeroize-audit — Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis.