Trail of Bits

• Audit Context BuildingSkill

  Builds audit context—architecture, trust boundaries, and assets—before deep security review.

• Check GitHub Actions workflows that run AI agents for injection risksSkill

  Trail of Bits' agentic-actions-auditor skill reviews GitHub Actions workflows that call AI coding agents such as Claude Code Action, Codex, Gemini CLI or…

• CodeQLSkill

  Runs CodeQL static analysis with interprocedural dataflow and taint tracking across major languages.

• Differential reviewSkill

  Security-focused differential review of code changes using git history and depth adapted to repo size.

• Entry Point AnalyzerSkill

  Maps state-changing entry points in smart contracts for security audits.

• Get a private repository ready to publish as open sourceSkill

  Trail of Bits' open-sourcing skill takes a repository through the checks needed before it goes public.

• Mutation TestingSkill

  Configures mutation-testing campaigns and investigates surviving mutants for test gaps.

• Property-Based TestingSkill

  Applies property-based testing to find edge-case bugs with generative properties.

• SemgrepSkill

  Runs and tunes Semgrep static analysis for security and correctness findings.

• Sort out the backlog of issues and PRs in a GitHub repoSkill

  Trail of Bits' github-triage skill works through the backlog of issues and PRs in a GitHub repository using the gh command-line tool.

• Supply Chain Risk AuditorSkill

  Audits dependencies for advisories, abandoned upstreams, publisher concentration, and install scripts.

• Variant AnalysisSkill

  Searches a codebase for other instances of a discovered bug’s root cause.

Show more