trailofbits

Clarify requirements before implementing. Do not use automatically, only when invoked explicitly.

Build deep architectural context through ultra-granular code analysis before vulnerability hunting

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

Search and extract data from Burp Suite project files (.burp) directly from the command line for use in Claude

Detect compiler-induced timing side-channels in cryptographic code

Interprets Culture Index survey results for individuals and teams

Security-focused differential review of code changes with git history analysis and blast radius estimation

Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

Verifies that code changes address security audit findings without introducing bugs

Interact with and understand the DWARF debugging format

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

Property-based testing guidance for multiple languages and smart contracts

Create custom Semgrep rules for detecting bug patterns and security vulnerabilities

Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation

Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

Specification-to-code compliance checker for blockchain audits with evidence-based alignment analysis

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

Find similar vulnerabilities and bugs across codebases using pattern-based analysis

Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.

Detects and verifies insecure default configurations