Security

A differential analysis skill for verifying that git commits properly address security audit findings. It helps map code changes to specific findings (like TOB-XXX format), detect potential bug introductions, and generate comprehensive fix review reports.

A comprehensive Firebase security scanner for Android APKs that identifies misconfigurations in authentication, Realtime Database, Firestore, Storage, Cloud Functions, and Remote Config. It extracts Firebase configuration from decompiled APKs and tests endpoints for common vulnerabilities like open signups, unauthenticated database access, and exposed storage buckets.

A comprehensive security-focused code review skill for analyzing pull requests, commits, and diffs. It uses git history for context, calculates blast radius of changes, checks test coverage, performs adversarial vulnerability analysis, and generates detailed markdown security reports with findings and recommendations.

This skill helps identify timing side-channel vulnerabilities in cryptographic implementations by analyzing compiled assembly or bytecode for dangerous instructions like variable-time division, secret-dependent branches, and non-constant-time comparisons. It supports C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby, and provides remediation guidance using patterns like Barrett reduction and constant-time selection.

A security auditing skill for TON blockchain smart contracts written in FunC. It detects three critical vulnerability patterns: integer-as-boolean misuse (where positive integers used as booleans cause logic errors), fake Jetton contract attacks (missing sender validation on transfer notifications), and gas drainage vulnerabilities (unchecked forward TON amounts). The skill provides detailed detection patterns, mitigation code, and testing recommendations.

A comprehensive token integration security analyzer based on Trail of Bits' checklist. Guides users through systematic analysis of ERC20/ERC721 tokens for conformity issues, weird token patterns (fee-on-transfer, rebasing, missing returns, etc.), owner privileges, and integration safety concerns. Provides structured report templates and checklists.

This skill provides comprehensive security auditing guidelines for Substrate/FRAME blockchain runtime modules (pallets). It documents 7 critical vulnerability patterns including arithmetic overflow, panic DoS, incorrect weights, and origin validation issues, with detection patterns, mitigations, and testing recommendations.

A specialized security scanner for Solana blockchain programs that detects 6 critical vulnerability patterns including arbitrary cross-program invocations, improper PDA validation, and missing signer/ownership checks. It provides detailed vulnerability reports with code examples and mitigation strategies for both native Solana and Anchor framework programs.

This skill guides Solidity developers through Trail of Bits' 5-step secure development workflow. It helps run Slither security scans, check upgradeability and ERC conformance, generate visual security diagrams, document security properties for fuzzing/verification, and review manual security areas like front-running and DeFi risks.

A comprehensive smart contract development advisor based on Trail of Bits' best practices. It systematically analyzes blockchain codebases to review architecture, check upgradeability patterns, identify common security pitfalls, assess dependencies, and evaluate testing coverage, providing prioritized recommendations for improvement.

A comprehensive security scanner for Cosmos SDK blockchains that identifies 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. It provides detection patterns, mitigation strategies, and testing recommendations for auditing Cosmos chains and CosmWasm contracts.

This skill systematically assesses codebase maturity using Trail of Bits' Building Secure Contracts framework. It evaluates 9 categories including arithmetic safety, access controls, complexity management, documentation, and testing, producing a detailed scorecard with ratings (0-4) and actionable improvement recommendations.

A comprehensive security auditing skill for Cairo/StarkNet smart contracts. It systematically scans for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, signature replay attacks, and unchecked access control, providing detailed remediation guidance and integration with the Caracal static analyzer.

This skill helps developers prepare their codebase for professional security audits using Trail of Bits' checklist methodology. It runs static analysis tools appropriate to your platform (Solidity, Rust, Go), analyzes test coverage, identifies dead code, and generates comprehensive documentation including flowcharts, user stories, and glossaries.

A security auditing skill for Algorand blockchain smart contracts. It guides users through scanning TEAL and PyTeal code for 11 critical vulnerability patterns including rekeying attacks, unchecked transaction fees, and access control issues, with detailed detection patterns and mitigation strategies.

This skill enables deep, line-by-line code analysis for security audits and architecture reviews. It provides structured frameworks including First Principles, 5 Whys, and 5 Hows methodologies to build comprehensive understanding of codebases before vulnerability hunting. The skill focuses purely on context building and explicitly excludes vulnerability findings or exploit reasoning.

A comprehensive security reference skill that provides OWASP security patterns, secrets management best practices, and automated security testing workflows. It includes code examples for input validation, authentication, JWT handling, password hashing, and security headers, along with GitHub Actions templates for CI/CD security scanning.

A comprehensive security threat modeling skill that analyzes codebases using STRIDE methodology across 8 phases. It generates data flow diagrams, identifies threats with CWE/CAPEC/ATT&CK mappings, validates risks with POC designs, and produces detailed security assessment reports. Supports AI/LLM security, multi-cloud environments, and includes a knowledge base of 974 CWEs, 615 attack patterns, and 323K+ CVEs.

Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials", "sensitive", "Varlock".

Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.

Security scanner for Claude Code skills. Use when users want to scan a skill before installing, check an installed skill's security, or analyze any skill from a GitHub URL, local path, or installed location. Triggers on "scan this skill", "check skill security", "is this skill safe", or when users provide a skill URL/path asking about its safety.