978 skills found ¡ Page 12 of 33
Jeffallan / fullstack-guardianBuilds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers
Jeffallan / java-architectUse when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming.
Jeffallan / security-reviewerIdentifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance
Jeffallan / test-masterGenerates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines
android / android-intent-securityBest practices for Android Intent security. Use this skill when auditing
android / android-permissions-securityAudits, detects gaps, and remediates Android permissions and IPC component
trailofbits / algorand-vulnerability-scannerScans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues
trailofbits / cairo-vulnerability-scannerScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay
trailofbits / solana-vulnerability-scannerScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing
trailofbits / substrate-vulnerability-scannerScans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks
trailofbits / ton-vulnerability-scannerScans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks
trailofbits / c-reviewPerforms comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities
trailofbits / codeqlScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo".
trailofbits / semgrepRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF.
trailofbits / testing-handbook-generatorGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires
trailofbits / graph-evolutionCompares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss
trailofbits / mermaid-to-proverifTranslates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files)
trailofbits / audit-prep-assistantPrepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments)
trailofbits / differential-reviewPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report
trailofbits / firebase-apk-scannerScans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions
trailofbits / post-patch-validationValidates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures.
trailofbits / burpsuite-project-parserSearches and explores Burp Suite project files (.burp) from the command line
trailofbits / entry-point-analyzerAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports.
trailofbits / semgrep-rule-creatorCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns
trailofbits / sharp-edgesIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes
trailofbits / cosmos-vulnerability-scannerScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities â chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns
trailofbits / agentic-actions-auditorAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference.
trailofbits / secure-workflow-guideGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas
trailofbits / fp-checkSystematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each
trailofbits / modern-cppGuides C++ code toward modern idioms (C++20/23/26)
