@trailofbits
Organization
More code: binary lifters @lifting-bits, blockchain @crytic, forks @trail-of-forks
95 skills1 repository 7.7K
Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.
Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.
Draft copy-ready /goal commands for long-running tasks in Claude Code and Codex. Turn a request into a checkable outcome with verification steps and stopping conditions, while flagging missing details instead of inventing them.
Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.
Create an isolated development container configured for Claude Code and the project's languages. Generate container files, editor settings, dependency setup commands, and persistent storage for Python, Node/TypeScript, Rust, and Go projects.
Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.
Set up Python projects and standalone scripts with uv for dependencies, ruff for code checks and formatting, and ty for type checking. Configure tests and project files, or migrate existing workflows when requested.
Assesses smart contract and blockchain codebases against Trail of Bits’ nine-category maturity framework. Produces evidence-backed ratings covering areas such as arithmetic, access controls, documentation, and testing, plus a prioritized improvement roadmap with effort estimates.
Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.
Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.
Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.
Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.
Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.
Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.
Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.
Review Solana and Anchor programs for six security patterns, including unsafe calls to other programs and missing account checks. Receive a complete coverage table, findings with file references and severity, and suggested fixes for identified issues.
Review smart contract projects against Trail of Bits development guidelines. Examines architecture, upgrade mechanisms, implementation, dependencies, and tests, then provides system documentation, identifies gaps, and recommends improvements in priority order with code references.
Interpret Culture Index behavioral profiles to understand individual traits, team balance, and possible strain from workplace adaptation. Use PDF or JSON data to inform hiring discussions, management approaches, onboarding plans, and conflict mediation.
Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.
Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.
Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.
Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.
Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)