测试与安全技能

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.

中文简介正在准备中。当前显示英语简介。

• Checking ERC20/ERC721 implementations against their standards
• Reviewing support for tokens with unusual transfer behavior
• Assessing administrator powers and upgrade risks

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

中文简介正在准备中。当前显示英语简介。

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

中文简介正在准备中。当前显示英语简介。

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

中文简介正在准备中。当前显示英语简介。

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

中文简介正在准备中。当前显示英语简介。

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

中文简介正在准备中。当前显示英语简介。

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

中文简介正在准备中。当前显示英语简介。

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.

中文简介正在准备中。当前显示英语简介。

• Set up and scope a mutation testing run
• Investigate code changes that tests fail to detect
• Distinguish equivalent changes from testing gaps

Review Solana and Anchor programs for six security patterns, including unsafe calls to other programs and missing account checks. Receive a complete coverage table, findings with file references and severity, and suggested fixes for identified issues.

中文简介正在准备中。当前显示英语简介。

• Reviewing Solana programs before launch
• Checking calls to other programs and their program IDs
• Inspecting address derivation and account validation

Audits arithmetic code for mixed units, decimal precision mistakes, and scaling errors. Adds comments identifying each value’s units and produces a summary of findings, unit definitions, and files reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing token amounts and price conversions in DeFi code
• Checking WAD/RAY scaling errors
• Documenting units and precision in existing formulas

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

中文简介正在准备中。当前显示英语简介。

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.

中文简介正在准备中。当前显示英语简介。

• Preparing a codebase for an external security audit
• Organizing fixes and missing tests before review
• Defining the review scope and a stable code version

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

中文简介正在准备中。当前显示英语简介。

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.

中文简介正在准备中。当前显示英语简介。

• Check an implementation against a specification
• Compare protocol code with a whitepaper
• Verify guarantees stated in a README

Assesses smart contract and blockchain codebases against Trail of Bits’ nine-category maturity framework. Produces evidence-backed ratings covering areas such as arithmetic, access controls, documentation, and testing, plus a prioritized improvement roadmap with effort estimates.

中文简介正在准备中。当前显示英语简介。

• Assessing the maturity of a smart contract project
• Identifying gaps in tests and documentation
• Reviewing access controls and operational practices together

Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.

中文简介正在准备中。当前显示英语简介。

• Combine findings from multiple security scanners
• Filter alerts by severity and remove duplicates
• Compare earlier and current results for new issues

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

中文简介正在准备中。当前显示英语简介。

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.

中文简介正在准备中。当前显示英语简介。

• Reviewing API designs for security mistakes
• Checking defaults and dangerous configuration combinations
• Assessing cryptographic API usability

Check whether a file creation or transformation task actually succeeded after an unclear execution error. Inspect output files and their contents to distinguish success, partial completion, and failure before deciding whether to retry.

中文简介正在准备中。当前显示英语简介。

• Checking output files after an unknown error
• Validating spreadsheet or JSON contents
• Deciding whether to retry or fix incomplete output

Check files created or edited by another agent, subprocess, or tool against explicit requirements. Verify the actual location, structure, counts, and key fields, then rerun with absolute paths when the results contradict the completion report.

中文简介正在准备中。当前显示英语简介。

• Checking files produced by another agent
• Verifying spreadsheet sheets and row counts
• Checking CSV headers and record counts