83 skills (repositories by trailofbits) · sorted by popularity
Inspect DWARF, the debug information stored with compiled code, to find functions and types, check structural integrity, and clarify specification details. Also helps write parsing tools using libraries such as pyelftools, libdwarf, or gimli.
Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.
Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.
Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.
Create an isolated development container configured for Claude Code and the project's languages. Generate container files, editor settings, dependency setup commands, and persistent storage for Python, Node/TypeScript, Rust, and Go projects.
Review Solana and Anchor programs for six security patterns, including unsafe calls to other programs and missing account checks. Receive a complete coverage table, findings with file references and severity, and suggested fixes for identified issues.
Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.
Audits arithmetic code for mixed units, decimal precision mistakes, and scaling errors. Adds comments identifying each value’s units and produces a summary of findings, unit definitions, and files reviewed.
Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.