83 个（trailofbits 的仓库） · 按人气排序
Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.
中文简介正在准备中。当前显示英语简介。
Review token contracts and the protocols that accept them for ERC20/ERC721 compliance, privileged controls, and unusual transfer behavior. Produces evidence-based risk assessments and prioritized fixes, with supply and holder analysis when deployed contract details are provided.
中文简介正在准备中。当前显示英语简介。
Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.
中文简介正在准备中。当前显示英语简介。
Write or modernize C++ with guidance on C++20, C++23, and C++26 features. Review memory ownership, error handling, and template constraints, with recommendations for compiler protections and runtime checks that detect bugs.
中文简介正在准备中。当前显示英语简介。
Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.
中文简介正在准备中。当前显示英语简介。
Get independent code reviews of uncommitted changes, branch differences, or individual commits using Codex or Antigravity. Receive findings with severity, locations, impact, and suggested corrections, and compare where the two reviewers agree or differ.
中文简介正在准备中。当前显示英语简介。
Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.
中文简介正在准备中。当前显示英语简介。
Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.
中文简介正在准备中。当前显示英语简介。
Prepares a project for open-source release by checking sensitive history, licensing, documentation, tests, and automated publishing. Helps identify gaps so people outside the project can build, use, and contribute to it.
中文简介正在准备中。当前显示英语简介。
Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.
中文简介正在准备中。当前显示英语简介。
Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.
中文简介正在准备中。当前显示英语简介。
Assesses smart contract and blockchain codebases against Trail of Bits’ nine-category maturity framework. Produces evidence-backed ratings covering areas such as arithmetic, access controls, documentation, and testing, plus a prioritized improvement roadmap with effort estimates.
中文简介正在准备中。当前显示英语简介。
Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.
中文简介正在准备中。当前显示英语简介。
Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.
中文简介正在准备中。当前显示英语简介。
Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.
中文简介正在准备中。当前显示英语简介。
Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.
中文简介正在准备中。当前显示英语简介。
Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.
中文简介正在准备中。当前显示英语简介。
Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.
中文简介正在准备中。当前显示英语简介。
Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.
中文简介正在准备中。当前显示英语简介。
Draft copy-ready /goal commands for long-running tasks in Claude Code and Codex. Turn a request into a checkable outcome with verification steps and stopping conditions, while flagging missing details instead of inventing them.
中文简介正在准备中。当前显示英语简介。
Guides agents to access GitHub repositories, pull requests, issues, and APIs through the authenticated gh command-line tool. Covers private repository access and recommends cloning repositories to read files locally, with commands for viewing GitHub information.
中文简介正在准备中。当前显示英语简介。
Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.
中文简介正在准备中。当前显示英语简介。
Runs repeated PR reviews and fixes on the directories changed by the current branch. Uses an installed reviewer, checks editing scope after each round, and reports whether blocking findings were resolved or the loop stopped.
中文简介正在准备中。当前显示英语简介。
Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.
中文简介正在准备中。当前显示英语简介。