测试与安全技能

Compares code relationships before and after a branch, pull request, or release change using Trailmark. Flags structural security regressions, such as removed authorization checks or newly reachable sensitive operations, and provides evidence for reviewers.

中文简介正在准备中。当前显示英语简介。

• Checking structural security changes before merging a PR
• Reviewing call paths after a security fix
• Assessing attack surface changes in a release

Test cryptographic code for timing side channels, where execution time can reveal secrets. Use dudect to detect statistical differences and Timecop with Valgrind to trace secret-dependent operations, then interpret results and retest changes.

中文简介正在准备中。当前显示英语简介。

• Checking cryptographic functions for secret-dependent timing
• Measuring timing differences in compiled binaries
• Tracing the cause of a suspected timing leak

Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.

中文简介正在准备中。当前显示英语简介。

• Finding similar issues after discovering a vulnerability
• Building CodeQL or Semgrep queries from a known bug
• Checking whether similar code shares the same root cause

Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.

中文简介正在准备中。当前显示英语简介。

• Preparing an open-source project for OSS-Fuzz enrollment
• Testing an OSS-Fuzz build locally before submission
• Reproducing crashes from OSS-Fuzz reports

Analyze code structure with Trailmark to identify complex functions, trace input flow, assess impact across connected code, and locate privilege boundaries. The resulting JSON provides detailed evidence for deciding where to focus a code audit.

中文简介正在准备中。当前显示英语简介。

• Prioritizing code audit targets
• Tracing input flow and assessing impact
• Inspecting unresolved calls and type references

Helps set up and run cargo-fuzz for Rust projects using Cargo. Guides fuzz testing, which tries varied inputs, from writing test harnesses to detecting memory errors, reproducing crashes, and checking which code was exercised.

中文简介正在准备中。当前显示英语简介。

• Adding fuzz tests to a Rust crate
• Generating structured test inputs
• Testing unsafe blocks or foreign-function calls

Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.

中文简介正在准备中。当前显示英语简介。

• Finding coverage gaps in cryptographic test vectors
• Creating invalid inputs that exercise validation checks
• Building test vectors shared across independent implementations

Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.

中文简介正在准备中。当前显示英语简介。

• Screening AI-generated security findings before human review
• Assessing whether a reported CVE warrants investigation
• Reviewing bug bounty submissions

Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.

中文简介正在准备中。当前显示英语简介。

• Testing cryptographic code against known attacks
• Comparing results across cryptographic libraries
• Investigating rejected or incorrectly accepted signatures

Evaluate how well existing tests catch code changes, then combine the results with function relationships. Get a report separating harmless findings, missing unit tests, and targets for fuzzing, which tests many generated inputs.

中文简介正在准备中。当前显示英语简介。

• Triage code changes that existing tests failed to catch
• Prioritize missing unit tests
• Find functions suited to fuzzing

Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.

中文简介正在准备中。当前显示英语简介。

• Tracing call paths from entry points to sensitive functions
• Prioritizing code for a security audit
• Connecting calls across language and RPC boundaries

Turn a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model, a file for formal security checks. It includes queries for secrecy, authentication, replay resistance, and forward secrecy where applicable.

中文简介正在准备中。当前显示英语简介。

• Converting a cryptographic protocol diagram into a .pv file
• Preparing session key secrecy checks
• Modeling authentication and replay resistance

Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.

中文简介正在准备中。当前显示英语简介。

• Checking whether a reported vulnerability is real
• Verifying the conditions needed to exploit a finding
• Reviewing suspected false positives

Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Cosmos SDK modules
• Reviewing IBC integrations
• Assessing chain security before launch

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.

中文简介正在准备中。当前显示英语简介。

• Checking ERC20/ERC721 implementations against their standards
• Reviewing support for tokens with unusual transfer behavior
• Assessing administrator powers and upgrade risks

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

中文简介正在准备中。当前显示英语简介。

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.

中文简介正在准备中。当前显示英语简介。

• Reviewing API designs for security mistakes
• Checking defaults and dangerous configuration combinations
• Assessing cryptographic API usability

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

中文简介正在准备中。当前显示英语简介。

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

中文简介正在准备中。当前显示英语简介。

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

中文简介正在准备中。当前显示英语简介。

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

中文简介正在准备中。当前显示英语简介。

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history