skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 85 files.

• agentic-actions-auditor

  Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlist…

  plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md on GitHub (opens in a new tab)

• audit-context-building

  Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.

  plugins/audit-context-building/skills/audit-context-building/SKILL.md on GitHub (opens in a new tab)

• algorand-vulnerability-scanner

  Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

  plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• audit-prep-assistant

  Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review…

  plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md on GitHub (opens in a new tab)

• cairo-vulnerability-scanner

  Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.

  plugins/building-secure-contracts/skills/cairo-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• code-maturity-assessor

  Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or block…

  plugins/building-secure-contracts/skills/code-maturity-assessor/SKILL.md on GitHub (opens in a new tab)

• cosmos-vulnerability-scanner

  Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

  plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• guidelines-advisor

  Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split…

  plugins/building-secure-contracts/skills/guidelines-advisor/SKILL.md on GitHub (opens in a new tab)

• secure-workflow-guide

  Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every ch…

  plugins/building-secure-contracts/skills/secure-workflow-guide/SKILL.md on GitHub (opens in a new tab)

• solana-vulnerability-scanner

  Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

  plugins/building-secure-contracts/skills/solana-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• substrate-vulnerability-scanner

  Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

  plugins/building-secure-contracts/skills/substrate-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• token-integration-analyzer

  Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Use when integrating or accepting arbitrary ERC20/ERC721 t…

  plugins/building-secure-contracts/skills/token-integration-analyzer/SKILL.md on GitHub (opens in a new tab)

• ton-vulnerability-scanner

  Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.

  plugins/building-secure-contracts/skills/ton-vulnerability-scanner/SKILL.md on GitHub (opens in a new tab)

• burpsuite-project-parser

  Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

  plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md on GitHub (opens in a new tab)

• c-review

  Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

  plugins/c-review/skills/c-review/SKILL.md on GitHub (opens in a new tab)

• chrome-mcp-troubleshooting

  Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.

  plugins/claude-in-chrome-troubleshooting/skills/chrome-mcp-troubleshooting/SKILL.md on GitHub (opens in a new tab)

• code-improver

  Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guards scope mechanically. Use when asked to 'improve this code until review passes', 'run an improvement loop with <reviewer>', or to iterate…

  plugins/code-improver/skills/code-improver/SKILL.md on GitHub (opens in a new tab)

• pr-improver

  Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolkit's review-pr). Use to fix review findings on a branch before opening or updating a pull request ('clean up this branch', 'fix this PR unti…

  plugins/code-improver/skills/pr-improver/SKILL.md on GitHub (opens in a new tab)

• skill-improver

  Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-reviewer agent. Use to fix skill quality issues, iteratively refine a skill, or resume a loop after an escalation ('fix my skill', 'improve…

  plugins/code-improver/skills/skill-improver/SKILL.md on GitHub (opens in a new tab)

• constant-time-analysis

  Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

  plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md on GitHub (opens in a new tab)

• interpreting-culture-index

  Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript analysis for trait prediction, candidate debrief, onboarding planning, and conflict mediation. Accepts extracted JSON or PD…

  plugins/culture-index/skills/interpreting-culture-index/SKILL.md on GitHub (opens in a new tab)

• devcontainer-setup

  Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Claude Code workspaces.

  plugins/devcontainer-setup/skills/devcontainer-setup/SKILL.md on GitHub (opens in a new tab)

• differential-review

  Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else…

  plugins/differential-review/skills/differential-review/SKILL.md on GitHub (opens in a new tab)

• dimensional-analysis

  Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol, offchain code, or other blockchain-related codebase with arithmetic. Prevents dimensional mismatches and catches formula bugs early.

  plugins/dimensional-analysis/skills/dimensional-analysis/SKILL.md on GitHub (opens in a new tab)

• dwarf-expert

  Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).

  plugins/dwarf-expert/skills/dwarf-expert/SKILL.md on GitHub (opens in a new tab)

• entry-point-analyzer

  Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWas…

  plugins/entry-point-analyzer/skills/entry-point-analyzer/SKILL.md on GitHub (opens in a new tab)

• firebase-apk-scanner

  Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.

  plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md on GitHub (opens in a new tab)

• fp-check

  Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.

  plugins/fp-check/skills/fp-check/SKILL.md on GitHub (opens in a new tab)

• gh-cli

  Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.

  plugins/gh-cli/skills/gh-cli/SKILL.md on GitHub (opens in a new tab)

• github-triage

  Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintainer-approved ones, and spawning review subagents for never-reviewed ones — then closes already-resolved issues with comments citing the resolving PR or commit, cross-links issues with their pending fix PRs, and assigns loc…

  plugins/github-triage/skills/github-triage/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• agent-skillsby addyosmani Production-grade engineering skills for AI coding agents. 107k stars · 25 skills
• paperclipby paperclipai The open-source app everyone uses to manage agents at work 103k stars · 30 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 97.3k stars · 13 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills