The whole ecosystem, one catalog.
738 results · page 2 of 25
- Add to your gateway
5c Poc VerifiersubagentSecurity
Verifies that each zeroize-audit PoC actually proves the vulnerability it claims to demonstrate. Reads PoC source code, finding details, and original source to check alignment between the PoC and the finding. Produces poc_verification.json consumed by the orchestrator.
- Add to your gateway
Adversarial ModelersubagentSecurity
Models attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies high-risk changes that need adversarial threat modeling and concrete attack vector analysis.
- Add to your gateway
Agentic Actions AuditorpluginSecurity
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)
- Add to your gateway
Audit Context BuildingpluginSecurity
Build deep architectural context through ultra-granular code analysis before vulnerability hunting
- Add to your gateway
Building Secure ContractspluginSecurity
Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.
- Add to your gateway
Data Flow AnalyzersubagentSecurity
Analyzes data flow from source to vulnerability sink, mapping trust boundaries, API contracts, environment protections, and cross-references. Spawned by fp-check during Phase 1 verification.
- Add to your gateway
Differential ReviewpluginSecurity
Security-focused differential review of code changes with git history analysis and blast radius estimation
- Add to your gateway
Dimensional AnalysispluginSecurity
Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol. Prevents dimensional mismatches and catches formula bugs early
- Add to your gateway
Entry Point AnalyzerpluginSecurity
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.
- Add to your gateway
Exploitability VerifiersubagentSecurity
Verifies whether a suspected vulnerability is actually exploitable by proving attacker control, mathematical bounds, and race condition feasibility. Spawned by fp-check during Phase 2 verification.
- Add to your gateway
Fp CheckpluginSecurity
Systematic false positive verification for security bug analysis with mandatory gate reviews
- Add to your gateway
Function AnalyzersubagentSecurity
Performs ultra-granular per-function deep analysis for security audit context building. Use when analyzing dense functions, data-flow chains, cryptographic implementations, or state machines.
- Add to your gateway
Gh ClipluginSecurity
Intercepts GitHub URL fetches and curl/wget commands, redirecting to the authenticated gh CLI.
- Add to your gateway
Insecure DefaultspluginSecurity
Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production
- Add to your gateway
Poc BuildersubagentSecurity
Creates proof-of-concept exploits (pseudocode, executable, and unit tests) demonstrating a verified vulnerability, plus negative PoCs showing exploit preconditions. Spawned by fp-check during Phase 4 verification.
- Add to your gateway
Semgrep Rule CreatorpluginSecurity
Create custom Semgrep rules for detecting bug patterns and security vulnerabilities
- Add to your gateway
Sharp EdgespluginSecurity
Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes
- Add to your gateway
Sharp Edges AnalyzersubagentSecurity
Evaluates APIs, configurations, and library interfaces for misuse resistance and footgun potential. Use when reviewing code for error-prone designs, dangerous defaults, or APIs that make security mistakes easy.
- Add to your gateway
Static AnalysispluginSecurity
Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
- Add to your gateway
Supply Chain Risk AuditorpluginSecurity
Audit supply-chain threat landscape of project dependencies for exploitation or takeover risk
- Add to your gateway
Testing Handbook SkillspluginSecurity
Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)
- Add to your gateway
TrailmarkpluginSecurity
Builds multi-language source code graphs for security analysis: call graphs, attack surface mapping, blast radius, taint propagation, complexity hotspots, and entry point enumeration. Generates Mermaid diagrams (call graphs, class hierarchies, dependency maps, heatmaps). Compares code graph snapshot
- Add to your gateway
trailofbits:audit-contextcommandSecurity
Builds deep architectural context before vulnerability hunting
- Add to your gateway
trailofbits:diff-reviewcommandSecurity
Performs security-focused differential review of code changes
- Add to your gateway
trailofbits:scan-apkcommandSecurity
Scans Android APKs for Firebase security misconfigurations
- Add to your gateway
trailofbits:variantscommandSecurity
Finds similar vulnerabilities using pattern-based analysis
- Add to your gateway
Variant AnalysispluginSecurity
Find similar vulnerabilities and bugs across codebases using pattern-based analysis
- Add to your gateway
Code ReviewersubagentSecurity
Code review expert for quality analysis, security vulnerabilities, and production reliability
- Add to your gateway
Graphql ArchitectsubagentSecurity
Master modern GraphQL with federation, performance optimization, and enterprise security. Build scalable schemas, implement advanced caching, and design real-time systems. Use PROACTIVELY for GraphQL architecture or performance optimization.
- Add to your gateway
Octopus Code ReviewsubagentSecurity
Expert code review skill leveraging the code-reviewer persona. Use when you need comprehensive code quality assessment, security vulnerability detection, or architecture review.
