Test design, vulnerability assessment, and quality assurance (13K skills)
Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.
Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.
Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.
Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
Create dictionaries of keywords and identifying byte sequences for fuzzing, or testing with generated inputs. Extract useful entries from code, binaries, or specifications, then configure fuzzers to explore parsing paths beyond initial input validation.
Build a custom fuzzer, a tool that tests code with many generated inputs, using LibAFL in Rust. Combine input mutation, execution feedback, scheduling, and target execution components when standard fuzzers offer insufficient control.
Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.
Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.
Evaluate how well existing tests catch code changes, then combine the results with function relationships. Get a report separating harmless findings, missing unit tests, and targets for fuzzing, which tests many generated inputs.
Turn a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model, a file for formal security checks. It includes queries for secrecy, authentication, replay resistance, and forward secrecy where applicable.
Measure which code fuzzing reaches as it tries many generated inputs. Use coverage reports to find unreachable areas, compare progress, and guide improvements to test harnesses, starting inputs, or dictionaries of useful input values.
Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.
Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.
Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.
Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.
Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.
Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.
Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.
Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.
Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.
Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.