Trail of Bits

Scan Solana programs for critical vulnerabilities to enhance security.

Conducts security-focused differential reviews of code changes to prevent vulnerabilities.

Scans Cosmos SDK modules and CosmWasm contracts for critical vulnerabilities that can halt chains or cause fund loss.

Annotates codebases with dimensional analysis to prevent formula bugs and dimensional mismatches.

Generates minimal macOS Seatbelt sandbox configurations for application isolation.

Clarify requirements before implementation to avoid miscommunication and errors.

Systematically verifies suspected security bugs to eliminate false positives with documented evidence.

Audits C/C++/Rust code for missing zeroization of sensitive data, ensuring secure handling of secrets.

Graph-informed mutation testing triage for identifying test gaps and fuzzing targets.

Scan Substrate/Polkadot pallets for critical vulnerabilities to enhance security.

Generate Claude Code skills from the Trail of Bits Testing Handbook for security testing tools and techniques.

Learn techniques for writing effective fuzzing harnesses across multiple programming languages.

Wycheproof provides test vectors for validating cryptographic implementations against known attacks.

Generates Mermaid diagrams from Trailmark code graphs for visualizing code architecture.

Run Semgrep static analysis scans on codebases with parallel execution for enhanced performance.

Detects insecure defaults that allow applications to run with weak security configurations.

LibAFL is a modular fuzzing library for building custom fuzzers with advanced features.

Parses and processes SARIF files from static analysis tools for actionable insights.

Detects timing side-channel vulnerabilities in cryptographic code.

Scans TON smart contracts for critical vulnerabilities in FunC code.

Scans Cairo/StarkNet smart contracts for critical vulnerabilities.

Design and structure multi-step workflow skills for Claude Code effectively.

Analyzes token implementations and integrations for security and conformity using a comprehensive checklist.

Create high-quality YARA-X detection rules for effective malware identification.

Fuzzing dictionaries enhance fuzzers with domain-specific tokens for effective testing.

Generates mutation-driven test vectors for cryptographic algorithms to improve coverage.

Conducts comprehensive structural analysis for codebases using Trailmark.

Diagnose and fix connectivity issues for the Claude in Chrome MCP extension.

Coverage analysis measures code exercised during fuzzing to enhance harness effectiveness and identify blockers.

A marketplace of skills from Trail of Bits enhancing AI-assisted security analysis and development workflows.

Systematic assessment of code maturity using a 9-category framework.

Scan Android APKs for Firebase security misconfigurations and vulnerabilities.

AFL++ enhances fuzzing performance with multi-core support for C/C++ projects.

Smart contract development advisor that analyzes codebases and provides actionable recommendations based on best practices.

Interprets Culture Index surveys and behavioral profiles for team and individual insights.

Create custom Semgrep rules to detect security vulnerabilities and code patterns.

Atheris is a coverage-guided fuzzer for Python code and C extensions, leveraging libFuzzer.

OSS-Fuzz offers free continuous fuzzing for open source projects, streamlining the testing process.

Compares code graphs across snapshots to identify security-relevant changes.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations.

Verifies code compliance with documentation for blockchain audits.

Create language variants of existing Semgrep rules for targeted applications.

Enables ultra-granular, line-by-line code analysis for deep architectural context before vulnerability discovery.

Scans Algorand smart contracts for 11 common vulnerabilities to enhance security.

Safely analyze and clean up local git branches and worktrees by categorizing them.

Ruzzy is a coverage-guided fuzzer for Ruby, enabling effective testing of Ruby code and C extensions.

Expertise for analyzing DWARF debug files and understanding the DWARF standard (v3-v5).

Techniques for patching code to overcome fuzzing obstacles like checksums and global state.

Analyzes codebases to provide a quick structural overview with language detection and entry point count.

Analyzes smart contract codebases to identify state-changing entry points for security audits.

Augments Trailmark code graphs with external audit findings for enhanced analysis.

Command-line tool for searching and analyzing Burp Suite project files (.burp).

Constant-time testing identifies timing side channels in cryptographic code to enhance security.

Configures mutation testing campaigns with mewt or muton, optimizing performance and scope.

Enhance smart contract security with a structured 5-step workflow.

Identify and analyze similar vulnerabilities across codebases using pattern-based techniques.

Configures Python projects with modern tooling for streamlined development.

Runs external LLM code reviews on code changes using OpenAI Codex or Google Gemini.

Generates sequence diagrams for cryptographic protocols from source code or specifications.

Evaluates project dependencies for risk of exploitation or takeover.

Builds and queries multi-language source code graphs for security analysis.

Prepares codebases for security reviews using Trail of Bits' checklist, enhancing code quality and documentation.

Creates devcontainers with Claude Code and language-specific tooling for isolated development.

Scans codebases for security vulnerabilities using CodeQL's advanced analysis techniques.

Iteratively improves Claude Code skills by fixing quality issues through automated review cycles.

Translates Mermaid sequence diagrams of cryptographic protocols into ProVerif models for formal verification.

cargo-fuzz is the leading fuzzing tool for Rust projects using Cargo, leveraging libFuzzer for effective testing.

Injects randomness into decision-making by drawing Tarot cards for vague prompts.

AddressSanitizer detects memory errors during fuzzing C/C++ code.

Coverage-guided fuzzer for C/C++ projects integrated with LLVM.

Debugs the Buttercup CRS on Kubernetes to diagnose service failures and resource issues.

Guidance for implementing property-based testing across multiple languages and smart contracts.

Identifies error-prone APIs and configurations to prevent security mistakes.