Trail of Bits

Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review StarkNet contracts before launch
• Audit L1-L2 bridge message handling
• Check protection against signature reuse

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Reviews Rust applications and libraries for security issues involving unsafe code, memory safety, concurrency, calls across language boundaries, panics, and async runtimes. Coordinates specialized reviewers and produces Markdown and SARIF reports, a format for analysis tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing unsafe Rust code
• Reviewing calls across language boundaries
• Checking concurrency and async runtime hazards

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing uncommitted changes for bugs
• Comparing Codex and Antigravity on the same branch diff
• Reviewing a specific commit for security issues

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Security checks before an Algorand contract audit
• Reviewing TEAL or PyTeal transaction validation
• Verifying fixes for reported vulnerabilities

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking ERC20/ERC721 implementations against their standards
• Reviewing support for tokens with unusual transfer behavior
• Assessing administrator powers and upgrade risks

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing workflows that run AI coding agents
• Tracing issue and PR content into agent prompts
• Checking sandbox settings and user allowlists

Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Refining a skill until critical and major findings are resolved
• Improving skill metadata, trigger descriptions, and references
• Tracking recurring findings across review rounds

Run repeated code reviews and fixes using an installed reviewer chosen by the user. The workflow tracks findings across rounds, checks that edits stay within scope, and reports whether blocking issues were resolved or further decisions are needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Repeat reviews and fixes for a module
• Improve code using a specific installed reviewer
• Keep automated edits within an agreed file scope

Audits arithmetic code for mixed units, decimal precision mistakes, and scaling errors. Adds comments identifying each value’s units and produces a summary of findings, unit definitions, and files reviewed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing token amounts and price conversions in DeFi code
• Checking WAD/RAY scaling errors
• Documenting units and precision in existing formulas

Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit a native C/C++ application for security flaws
• Review a daemon or service for memory safety
• Investigate integer overflows and race conditions

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing an approach for a casually delegated task
• Breaking a tie between reasonable options
• Finding a new angle when planning stalls

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Draft copy-ready /goal commands for long-running tasks in Claude Code and Codex. Turn a request into a checkable outcome with verification steps and stopping conditions, while flagging missing details instead of inventing them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare a goal for a long-running development task
• Clarify completion criteria for an existing goal
• Shorten a goal prompt to fit the character limit

Guides agents to access GitHub repositories, pull requests, issues, and APIs through the authenticated gh command-line tool. Covers private repository access and recommends cloning repositories to read files locally, with commands for viewing GitHub information.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Viewing GitHub pull requests and issues
• Accessing private repositories with authentication
• Querying the GitHub API through gh

Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Clean up resolved issues left open
• Link issues to pull requests with pending fixes
• Estimate priorities and change sizes for outstanding work