trailofbits

by Emilio López & Will Vandevanter

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)

by Omar Inuwa

Understand a codebase before looking for bugs in it. Reads it function by function, records what each one assumes and depends on, and saves the write-ups to files instead of filling up the conversation.

by Omar Inuwa && Paweł Płatek

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

by Will Vandevanter

Search and extract data from Burp Suite project files (.burp) for security analysis

by Paweł Płatek

Comprehensive C/C++ security code review, with coverage verified against a parse of the source

by Dan Guido

Diagnose and fix Claude in Chrome MCP extension connectivity issues

by Paweł Płatek

Improves code targets — skills, plugins, or a branch's changes — through an autonomous review-and-fix workflow with a pluggable reviewer (any installed skill or agent), a cross-round findings ledger, oscillation escalation, and a mechanical scope guard.

by Scott Arciszewski

Detect compiler-induced timing side-channels in cryptographic code

by Dan Guido

Interprets Culture Index survey results for individuals and teams

by Alexis Challande

Create pre-configured devcontainers with Claude Code and language-specific tooling

by Omar Inuwa

Security-focused differential review of code changes with git history analysis and blast radius estimation

by Coriolan Pinhas & Benjamin Samuels

Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol. Prevents dimensional mismatches and catches formula bugs early.

by Evan Hellman

Analyze DWARF debug information: parse and search DIEs with dwarfdump and readelf, verify debug info integrity, and write DWARF parsing code

by Nicolas Donboly

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

by Nick Sellier

Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

by Maciej Domanski

Systematic false positive verification for security bug analysis with mandatory gate reviews

by William Tan

Intercepts GitHub URL fetches (WebFetch and MCP fetch tools) and curl/wget commands, redirecting to the authenticated gh CLI.

by Henrik Brodin

Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.

by Evan Sultanik

Triages a repository's open GitHub issues and pull requests via the gh CLI: optionally merges ready bot and maintainer-approved PRs and spawns review subagents for unreviewed ones, closes already-resolved issues with referenced explanations, cross-links issues with pending fix PRs, and assigns local-only priority and change-size estimates.

by Paweł Płatek

Drafts copy-ready /goal commands for goal mode in Claude Code and Codex: verifiable completion conditions with stop bounds, normalized to a single line under the 4,000-character cap.

by Trail of Bits

Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production

by Scott Arciszewski

Draws the 12 Houses of the Zodiac Tarot spread using cryptographic randomness to add 100+ bits of entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous.

by Julius Alexandre

Modern C++ best practices (C++20/23/26). Use when writing C++ code, creating new C++ projects, or modernizing legacy C++ patterns.

by William Tan

Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.