Trail of Bits

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing an approach for a casually delegated task
• Breaking a tie between reasonable options
• Finding a new angle when planning stalls

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Draft copy-ready /goal commands for long-running tasks in Claude Code and Codex. Turn a request into a checkable outcome with verification steps and stopping conditions, while flagging missing details instead of inventing them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare a goal for a long-running development task
• Clarify completion criteria for an existing goal
• Shorten a goal prompt to fit the character limit

Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up and scope a mutation testing run
• Investigate code changes that tests fail to detect
• Distinguish equivalent changes from testing gaps

Create an isolated development container configured for Claude Code and the project's languages. Generate container files, editor settings, dependency setup commands, and persistent storage for Python, Node/TypeScript, Rust, and Go projects.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Add devcontainer support to a project
• Set up an isolated Claude Code workspace
• Configure development tools for a multilingual project

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Combine findings from multiple security scanners
• Filter alerts by severity and remove duplicates
• Compare earlier and current results for new issues

Guides agents to access GitHub repositories, pull requests, issues, and APIs through the authenticated gh command-line tool. Covers private repository access and recommends cloning repositories to read files locally, with commands for viewing GitHub information.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Viewing GitHub pull requests and issues
• Accessing private repositories with authentication
• Querying the GitHub API through gh

Prepares a project for open-source release by checking sensitive history, licensing, documentation, tests, and automated publishing. Helps identify gaps so people outside the project can build, use, and contribute to it.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing a private repository for public release
• Choosing and documenting a project license
• Improving README and contribution instructions

Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit a native C/C++ application for security flaws
• Review a daemon or service for memory safety
• Investigate integer overflows and race conditions

Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing uncommitted changes for bugs
• Comparing Codex and Antigravity on the same branch diff
• Reviewing a specific commit for security issues

Assesses smart contract and blockchain codebases against Trail of Bits’ nine-category maturity framework. Produces evidence-backed ratings covering areas such as arithmetic, access controls, documentation, and testing, plus a prioritized improvement roadmap with effort estimates.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the maturity of a smart contract project
• Identifying gaps in tests and documentation
• Reviewing access controls and operational practices together

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Review Solana and Anchor programs for six security patterns, including unsafe calls to other programs and missing account checks. Receive a complete coverage table, findings with file references and severity, and suggested fixes for identified issues.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Solana programs before launch
• Checking calls to other programs and their program IDs
• Inspecting address derivation and account validation

Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing API designs for security mistakes
• Checking defaults and dangerous configuration combinations
• Assessing cryptographic API usability

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cleaning up a branch before opening a pull request
• Fixing review findings before updating a pull request
• Repeating reviews after each fix

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing custom Cosmos SDK modules
• Reviewing IBC integrations
• Assessing chain security before launch