trailofbits

Detects memory errors like buffer overflows and use-after-free bugs in C/C++ code during fuzzing.

Multi-core fuzzing tool for C/C++ projects with enhanced performance and advanced features.

Scans GitHub Actions workflows for security vulnerabilities in AI agent integrations and detects prompt injection attack vectors in CI/CD pipelines.

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks and access control issues.

Prompts clarification of ambiguous requirements before proceeding with implementation.

Coverage-guided fuzzer for testing Python code and C extensions through automated input generation.

Maps SARIF and weAudit security findings onto code graphs, linked by file and line location.

Performs line-by-line code analysis to establish detailed architectural context for vulnerability and bug detection.

Prepares codebases for security review by running analysis tools, improving test coverage, and generating documentation.

Search and extract data from Burp Suite project files using regex patterns and command-line queries.

Analyzes C/C++ code for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.

Scans Cairo and StarkNet smart contracts for critical vulnerabilities including arithmetic overflow and messaging issues.

Fuzz test Rust projects with libFuzzer integration through Cargo.

Diagnoses and resolves connectivity issues with the Claude in Chrome MCP extension.

Evaluates codebase against nine security and quality dimensions with evidence-based ratings and recommendations.

Scans codebases for security vulnerabilities using interprocedural data flow and taint tracking analysis.

Detects timing side-channel vulnerabilities in cryptographic code across multiple programming languages.

Detects timing side channels in cryptographic code to prevent timing-based attacks.

Scans Cosmos SDK modules and CosmWasm contracts for consensus-critical vulnerabilities including chain halts, fund loss, and state divergence.

Measures code exercised during fuzzing to assess harness effectiveness and identify blockers.

Extracts protocol message flows from specifications, code, or formal models and generates annotated sequence diagrams.

Analyzes Culture Index behavioral profiles and assessments for team dynamics, hiring, and conflict resolution.

Diagnoses and troubleshoots Buttercup Cyber Reasoning System pods and services running on Kubernetes.

Creates isolated development containers with Claude Code and language-specific tooling for Python, Node, Rust, and Go.

Generates Mermaid diagrams visualizing code architecture, call graphs, dependencies, class hierarchies, and data flows.

Analyzes code changes for security risks with context-aware depth and blast radius assessment.

Annotates code with dimensional analysis comments to document units, dimensions, and catch arithmetic vulnerabilities.

Analyzes DWARF debug files and explains the DWARF debug format standard across versions 3-5.

Identifies state-changing functions in smart contracts and categorizes them by access level for security auditing.

Scans Android APKs for Firebase security misconfigurations, exposed databases, storage buckets, and authentication issues.

Systematically verifies suspected security bugs to determine if they are true positives or false positives with documented evidence.

Guides fuzzers with domain-specific tokens for testing parsers, protocols, and format-specific code.

Learn techniques for writing effective fuzzing harnesses across multiple programming languages.

Patch code barriers like checksums and global state that block fuzzer progress.

Analyzes mutation testing results using call graphs to identify test gaps and weak coverage areas.

Analyzes and safely removes local git branches and worktrees by detecting merged, squash-merged, superseded, or abandoned work.

Execute authenticated GitHub operations using the gh CLI instead of direct API calls.

Compares code structure between snapshots to detect security-relevant changes like new attack paths and taint propagation shifts.

Analyzes smart contract code against Trail of Bits best practices and generates documentation, security assessments, and actionable recommendations.

Detects hardcoded secrets, weak authentication, and permissive security configurations that enable insecure production deployments.

Uses a 12-house Tarot spread to resolve ambiguous requests and inject guided randomness into planning.

Build custom fuzzers with modular components for advanced fuzzing, mutations, and specialized targets.

Coverage-guided fuzzing for C/C++ code compiled with Clang.

Converts Mermaid sequence diagrams of cryptographic protocols into ProVerif formal verification models.

Configures Python projects with modern tooling including uv, ruff, and type checking.

Configures mutation testing campaigns with mewt or muton, optimizing targets and timeouts for your test runs.

Sets up continuous fuzzing infrastructure and enrolls open source projects in free automated fuzz testing.

Guides you through property-based testing for code and smart contracts across multiple languages.

Analyzes Rust code for unsafe blocks, memory safety issues, concurrency hazards, and FFI vulnerabilities.

Coverage-guided fuzzer for Ruby code and C extensions by Trail of Bits.

Parses and processes SARIF files from static analysis tools, handling filtering, deduplication, and format conversion.

Generates minimal macOS Seatbelt sandbox configurations with allowlist-based profiles.

Runs external LLM code reviews on uncommitted changes, diffs, or commits using OpenAI or Google models.

Guides smart contract security through automated scanning, conformance checks, visual diagrams, and property documentation.

Run static analysis scans on codebases to detect vulnerabilities, bugs, and security issues across multiple languages.

Generates custom Semgrep rules to detect security vulnerabilities, bugs, and specific code patterns in static analysis.

Generates language-specific variants of Semgrep rules with test directories for target languages.

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes.

Iteratively reviews and refixes Claude Code skills until they meet quality standards.

Detects critical security vulnerabilities in Solana programs including CPI exploits, PDA validation flaws, and signer checks.

Verifies that code implementations match their technical specifications and documentation requirements.

Scans Substrate pallets for critical vulnerabilities including overflow, panic DoS, incorrect weights, and origin checks.

Identifies dependencies at heightened risk of exploitation or takeover to assess supply chain vulnerabilities.

Generates Claude Code skills for security testing tools by analyzing the Trail of Bits Testing Handbook.

Analyzes token implementations and integrations for ERC20/ERC721 conformity, detects non-standard patterns, and assesses contract risks.

Scans TON smart contracts for critical vulnerabilities including integer-as-boolean misuse, fake Jettons, and unsafe forward operations.

Builds and queries source code graphs with security analysis for attack surface mapping and taint propagation tracking.

Analyzes Trailmark code structure to identify hotspots, taint paths, blast radius, and privilege boundaries.

Analyzes a codebase to detect languages, count entry points, and list dependencies.

Find similar vulnerabilities and bugs across codebases using pattern-based analysis.

Generates cryptographic test vectors by identifying uncovered code paths through mutation testing.

Guides structuring multi-step Claude Code skills with phases, routing, delegation, and safety gates.

Test cryptographic implementations against known attacks and edge cases with comprehensive test vectors.

Guides creation and optimization of YARA-X malware detection rules with best practices for performance and accuracy.

Detects missing zeroization of sensitive data in source code and identifies compiler optimization removals.