83 skills (repositories by trailofbits) · sorted by popularity
Evaluate how well existing tests catch code changes, then combine the results with function relationships. Get a report separating harmless findings, missing unit tests, and targets for fuzzing, which tests many generated inputs.
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.
Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.
Writes and reviews Lean 4 proofs, machine-checked arguments for mathematics or specifications. Follows Mathlib conventions to organize definitions and lemmas, fill proof gaps, refactor lengthy proofs, and establish automated checks for unproved claims and style.
Guides fuzz testing for Ruby libraries and gems with Ruzzy, using varied inputs to find failures. Covers pure Ruby and C extensions, including test harnesses, memory error detection, environment setup, and crash reproduction.
Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.
Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.
Test cryptographic code for timing side channels, where execution time can reveal secrets. Use dudect to detect statistical differences and Timecop with Valgrind to trace secret-dependent operations, then interpret results and retest changes.
Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.
Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.
Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.
Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.
Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.
Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.
Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.
Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.
Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.
Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.
Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.
Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.
Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.