全部 Agent Skills
41,263 个结果
- Pr ImproverTrail of Bits官方Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolkit's review-pr).
- Prepare RegressionTrail of Bits官方Use when pinning before/after sources and collecting PR or commit context for a regression investigation.
- Property Based TestingTrail of Bits官方Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order…
- Prove PatchTrail of Bits官方Use when a local security patch commit needs independent scoped and three-arm proof.
- Regression HuntTrail of Bits官方Use when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.
- Replay RegressionTrail of Bits官方Use when independently verifying a supplied PoC against fresh live before/after deployments.
- Report RegressionsTrail of Bits官方Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
- Reproduce BugTrail of Bits官方Use when a named runtime or compiler bug in a local repository needs independent reproduction.
- Reproduce RegressionTrail of Bits官方Use when deploying before/after systems and building a live-system PoC for a regression candidate.
- Review WalkthroughTrail of Bits官方Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.
- Rust ReviewTrail of Bits官方Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.
- RuzzyTrail of Bits官方Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem, testing a Ruby C extension for memory safety, or asking how to fuzz Ruby at all.
- Sarif ParsingTrail of Bits官方Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
- Second OpinionTrail of Bits官方Runs external LLM code reviews (OpenAI Codex or Google Gemini CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, or mentions /second-opinion.
- Secure Workflow GuideTrail of Bits官方Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
- SemgrepTrail of Bits官方Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF.
- Semgrep Rule CreatorTrail of Bits官方Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
- Semgrep Rule Variant CreatorTrail of Bits官方Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
- Sharp EdgesTrail of Bits官方Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.
- Skill ImproverTrail of Bits官方Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-reviewer agent.
- Slicing Code ContextTrail of Bits官方Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to constrained or locally hosted models without exposing the full repository.
- Solana Vulnerability ScannerTrail of Bits官方Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
- Spec To Code ComplianceTrail of Bits官方Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
- Substrate Vulnerability ScannerTrail of Bits官方Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.