83 个（trailofbits 的仓库） · 按人气排序
Diagnose Claude in Chrome connection failures on macOS by checking native messaging hosts, the processes linking Chrome to Claude, and their settings. It guides fixes for competing configurations, stale wrappers, and session conflicts, including restart steps.
中文简介正在准备中。当前显示英语简介。
Turn a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model, a file for formal security checks. It includes queries for secrecy, authentication, replay resistance, and forward secrecy where applicable.
中文简介正在准备中。当前显示英语简介。
Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.
中文简介正在准备中。当前显示英语简介。
Turn Trail of Bits Testing Handbook content into Claude Code skills for security testing. Creates or refreshes SKILL.md files using templates for tools, fuzzers, techniques, and subject areas, then validates structure and links between skills.
中文简介正在准备中。当前显示英语简介。
Turn cryptographic code or specifications into sequence diagrams showing who sends each message, which cryptographic operations occur, and where failures stop the exchange. Outputs include Mermaid source, a plain text diagram, and a protocol summary.
中文简介正在准备中。当前显示英语简介。
Compare code structure across two commits, tags, or directories to identify security-relevant changes. Produces a report on new attack paths, privilege boundaries, complexity, and how widely a change could affect other functions.
中文简介正在准备中。当前显示英语简介。
Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.
中文简介正在准备中。当前显示英语简介。
Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.
中文简介正在准备中。当前显示英语简介。
Identify checks and changing global state that block fuzzing, then adjust them in fuzzing builds. The skill covers targeted validation bypasses, repeatable behavior, coverage comparisons, and checks for false crash reports introduced by patches.
中文简介正在准备中。当前显示英语简介。
Set up libFuzzer to test C/C++ code with varied inputs guided by which code paths run. Build test harnesses, manage sample inputs and dictionaries, enable error detectors, and reproduce crashes or investigate stalled coverage.
中文简介正在准备中。当前显示英语简介。
Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.
中文简介正在准备中。当前显示英语简介。
Helps set up and run cargo-fuzz for Rust projects using Cargo. Guides fuzz testing, which tries varied inputs, from writing test harnesses to detecting memory errors, reproducing crashes, and checking which code was exercised.
中文简介正在准备中。当前显示英语简介。
Audit C/C++ and Rust code for secrets left in memory. It checks missing or incomplete wipes, examines compiler output for removed cleanup operations, and produces reports with evidence and suggested fixes.
中文简介正在准备中。当前显示英语简介。
Create Mermaid diagrams from code relationships parsed by Trailmark. Visualize function calls, class inheritance, module dependencies, class members, complexity hotspots, and paths from inputs to sensitive functions, with adjustable focus, depth, and layout.
中文简介正在准备中。当前显示英语简介。
Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.
中文简介正在准备中。当前显示英语简介。
Test cryptographic code for timing side channels, where execution time can reveal secrets. Use dudect to detect statistical differences and Timecop with Valgrind to trace secret-dependent operations, then interpret results and retest changes.
中文简介正在准备中。当前显示英语简介。
Analyze code structure with Trailmark to identify complex functions, trace input flow, assess impact across connected code, and locate privilege boundaries. The resulting JSON provides detailed evidence for deciding where to focus a code audit.
中文简介正在准备中。当前显示英语简介。
Evaluate how well existing tests catch code changes, then combine the results with function relationships. Get a report separating harmless findings, missing unit tests, and targets for fuzzing, which tests many generated inputs.
中文简介正在准备中。当前显示英语简介。
Create dictionaries of keywords and identifying byte sequences for fuzzing, or testing with generated inputs. Extract useful entries from code, binaries, or specifications, then configure fuzzers to explore parsing paths beyond initial input validation.
中文简介正在准备中。当前显示英语简介。
Measure which code fuzzing reaches as it tries many generated inputs. Use coverage reports to find unreachable areas, compare progress, and guide improvements to test harnesses, starting inputs, or dictionaries of useful input values.
中文简介正在准备中。当前显示英语简介。
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
中文简介正在准备中。当前显示英语简介。
Builds and improves C/C++ and Rust fuzzing harnesses, the entry points that feed generated test data into code. Helps structure inputs, reach more code paths, and address crashes caused by inconsistent test behavior.
中文简介正在准备中。当前显示英语简介。
Build a custom fuzzer, a tool that tests code with many generated inputs, using LibAFL in Rust. Combine input mutation, execution feedback, scheduling, and target execution components when standard fuzzers offer insufficient control.
中文简介正在准备中。当前显示英语简介。
Select relevant code using Trailmark's map of function relationships, then delegate explanation, review, or edit proposals to a smaller model. Limit the supplied source, check cited evidence, and verify proposed changes before applying them.
中文简介正在准备中。当前显示英语简介。