Trail of Bits

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

中文简介正在准备中。当前显示英语简介。

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

中文简介正在准备中。当前显示英语简介。

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

中文简介正在准备中。当前显示英语简介。

• Security checks before an Algorand contract audit
• Reviewing TEAL or PyTeal transaction validation
• Verifying fixes for reported vulnerabilities

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

中文简介正在准备中。当前显示英语简介。

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.

中文简介正在准备中。当前显示英语简介。

• Refining a skill until critical and major findings are resolved
• Improving skill metadata, trigger descriptions, and references
• Tracking recurring findings across review rounds

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

中文简介正在准备中。当前显示英语简介。

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Audits arithmetic code for mixed units, decimal precision mistakes, and scaling errors. Adds comments identifying each value’s units and produces a summary of findings, unit definitions, and files reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing token amounts and price conversions in DeFi code
• Checking WAD/RAY scaling errors
• Documenting units and precision in existing formulas

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

中文简介正在准备中。当前显示英语简介。

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

中文简介正在准备中。当前显示英语简介。

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

中文简介正在准备中。当前显示英语简介。

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Use a randomized tarot spread to guide loosely defined tasks or choose among reasonable approaches. It interprets 36 cards across 12 areas, turning their themes into concrete next steps and possible investigation angles.

中文简介正在准备中。当前显示英语简介。

• Choosing an approach for a casually delegated task
• Breaking a tie between reasonable options
• Finding a new angle when planning stalls

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

中文简介正在准备中。当前显示英语简介。

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.

中文简介正在准备中。当前显示英语简介。

• Cleaning up a branch before opening a pull request
• Fixing review findings before updating a pull request
• Repeating reviews after each fix

Draft copy-ready /goal commands for long-running tasks in Claude Code and Codex. Turn a request into a checkable outcome with verification steps and stopping conditions, while flagging missing details instead of inventing them.

中文简介正在准备中。当前显示英语简介。

• Prepare a goal for a long-running development task
• Clarify completion criteria for an existing goal
• Shorten a goal prompt to fit the character limit

Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.

中文简介正在准备中。当前显示英语简介。

• Set up and scope a mutation testing run
• Investigate code changes that tests fail to detect
• Distinguish equivalent changes from testing gaps

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

中文简介正在准备中。当前显示英语简介。

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Create an isolated development container configured for Claude Code and the project's languages. Generate container files, editor settings, dependency setup commands, and persistent storage for Python, Node/TypeScript, Rust, and Go projects.

中文简介正在准备中。当前显示英语简介。

• Add devcontainer support to a project
• Set up an isolated Claude Code workspace
• Configure development tools for a multilingual project

Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Cosmos SDK modules
• Reviewing IBC integrations
• Assessing chain security before launch

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Run repeated code reviews and fixes using an installed reviewer chosen by the user. The workflow tracks findings across rounds, checks that edits stay within scope, and reports whether blocking issues were resolved or further decisions are needed.

中文简介正在准备中。当前显示英语简介。

• Repeat reviews and fixes for a module
• Improve code using a specific installed reviewer
• Keep automated edits within an agreed file scope