스킬 찾기

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing workflows that run AI coding agents
• Tracing issue and PR content into agent prompts
• Checking sandbox settings and user allowlists

Review smart contract security through five steps covering Slither scans, special features, diagrams, documented safety conditions, and manual checks. Get project-specific findings, testing setup guidance, and a prioritized action plan for development or deployment reviews.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review smart contract security before deployment
• Triage Slither findings and false positives
• Visualize inheritance and access permissions

Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a reported vulnerability is real
• Verifying the conditions needed to exploit a finding
• Reviewing suspected false positives

Run repeated code reviews and fixes using an installed reviewer chosen by the user. The workflow tracks findings across rounds, checks that edits stay within scope, and reports whether blocking issues were resolved or further decisions are needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Repeat reviews and fixes for a module
• Improve code using a specific installed reviewer
• Keep automated edits within an agreed file scope

Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing uncommitted changes for bugs
• Comparing Codex and Antigravity on the same branch diff
• Reviewing a specific commit for security issues

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing a codebase for an external security audit
• Organizing fixes and missing tests before review
• Defining the review scope and a stable code version

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Assesses smart contract and blockchain codebases against Trail of Bits’ nine-category maturity framework. Produces evidence-backed ratings covering areas such as arithmetic, access controls, documentation, and testing, plus a prioritized improvement roadmap with effort estimates.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the maturity of a smart contract project
• Identifying gaps in tests and documentation
• Reviewing access controls and operational practices together

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Refining a skill until critical and major findings are resolved
• Improving skill metadata, trigger descriptions, and references
• Tracking recurring findings across review rounds

Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Clean up resolved issues left open
• Link issues to pull requests with pending fixes
• Estimate priorities and change sizes for outstanding work

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check an implementation against a specification
• Compare protocol code with a whitepaper
• Verify guarantees stated in a README

Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing an approach for a casually delegated task
• Breaking a tie between reasonable options
• Finding a new angle when planning stalls

Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up and scope a mutation testing run
• Investigate code changes that tests fail to detect
• Distinguish equivalent changes from testing gaps

Review smart contract projects against Trail of Bits development guidelines. Examines architecture, upgrade mechanisms, implementation, dependencies, and tests, then provides system documentation, identifies gaps, and recommends improvements in priority order with code references.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review smart contract architecture
• Check upgrade and proxy designs
• Identify gaps in specifications and documentation