trailofbits

semgrep

Use it when:: You want a first-pass static security scan of a codebase, before or alongside code review.
It does:: Detects languages, checks for Semgrep Pro, proposes rulesets and a mode, waits for your explicit yes, then runs them through its bundled script.

tool local cli official security code-review semgrep

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 10.2K; top 48%
Weekly Downloads: 354; top 48%

differential-review

Use it when:: You're checking a change for vulnerabilities, a re-introduced old bug, what else it could break, or modified code no test covers.
It does:: Rates each changed file's risk, git-blames removed code, counts callers to size the blast radius, checks test coverage and models attackers for high-risk changes.

workflow local none official security code-review testing git

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 10K; top 49%
Weekly Downloads: 535; top 33%

supply-chain-risk-auditor

Use it when:: You need to judge the third-party package risk in a project, for example before a security engagement.
It does:: Runs a bundled collector over each direct dependency and the whole lockfile tree, renders its report, then adds upgrade paths and replacement candidates.

tool local cli official security node python go

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 8.9K; bottom 45%
Weekly Downloads: 364; top 48%

codeql

Use it when:: You want interprocedural security analysis of Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby or Swift code.
It does:: Builds a CodeQL database, checks it really extracted code, adds data-extension models for project-specific sources and sinks, then runs an explicit query suite.

tool local cli official security code-review codeql

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 8.8K; bottom 44%
Weekly Downloads: 245; bottom 44%

secure-workflow-guide

Use it when:: You want to secure a smart contract end to end, on every check-in or before deployment, rather than hunt one bug.
It does:: Runs Slither's detectors and the upgradeability and ERC checks that apply, draws three security diagrams, helps write security properties, then reviews what tools miss.

workflow local cli official security web3 testing solidity slither

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7.8K; bottom 40%
Weekly Downloads: 198; bottom 39%

property-based-testing

Use it when:: Code has an algebraic shape, such as encode/decode pairs, parsers, normalizers, sort order or contract state, that example tests only spot-check.
It does:: Picks the strongest property the code supports from a catalog, and loads its guide for writing, refactoring, reviewing or reading a failure.

guidelines none none official testing

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7.6K; bottom 39%
Weekly Downloads: 312; bottom 49%

sharp-edges

Use it when:: You're reviewing an API, library, config schema or auth interface for how easily developers could misuse it.
It does:: Maps security-relevant choice points, probes zero, empty, negative and swapped values, and imagines a malicious, a lazy and a confused developer.

workflow none none official security code-review architecture

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7.6K; bottom 39%
Weekly Downloads: 317; bottom 50%

fp-check

Use it when:: A scanner, reviewer or another agent flagged a bug and you need to know if it's real and exploitable, not hunt for new ones.
It does:: Restates each claim, traces source to sink, proves attacker control and impact, sketches a proof of concept, argues against itself, then applies six gates.

workflow local subagents official security verification debugging

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 7.5K; bottom 38%
Weekly Downloads: 262; bottom 46%

code-maturity-assessor

Use it when:: You want to grade how mature, tested and documented a smart contract or blockchain project is against a fixed rubric.
It does:: Explores the code, rates nine categories from Missing to Strong with file:line evidence, and asks you about processes the code can't show.

workflow none none official security web3 code-quality

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7.5K; bottom 38%
Weekly Downloads: 191; bottom 38%

audit-context-building

Use it when:: You're starting an audit, threat model or architecture review on code you don't know yet.
It does:: Dispatches a workflow that analyzes each function in its own subagent and returns compact records, keeping the long analysis out of your context.

workflow local claude-code subagents official security architecture

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7.3K; bottom 36%
Weekly Downloads: 280; bottom 47%

agentic-actions-auditor

Use it when:: Your CI runs Claude Code Action, Gemini CLI, OpenAI Codex or GitHub AI Inference and you want to know whether outsiders can steer it.
It does:: Finds the AI steps, follows composite actions and reusable workflows one level deep, captures triggers, env, permissions and sandbox settings, then checks nine attack vectors.

workflow none none official security ci guardrails github

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 7.1K; bottom 35%
Weekly Downloads: 217; bottom 41%

variant-analysis

Use it when:: You've found one bug and want to know where else its root cause shows up, including "are there others like this?".
It does:: States the root cause, writes a pattern matching only the known bug, then generalizes one element at a time until over half the matches are noise.

workflow none cli official security code-review semgrep codeql

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 7K; bottom 34%
Weekly Downloads: 280; bottom 47%

sarif-parsing

Use it when:: You have SARIF output from CodeQL, Semgrep or another scanner and need to query, merge, deduplicate, diff or gate CI on it.
It does:: Picks jq for quick queries, or Python with pysarif, sarif-tools or its bundled helpers for scripts, aggregation and CI checks.

guidelines none none official security ci code-review sarif

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6.4K; bottom 31%
Weekly Downloads: 229; bottom 42%

spec-to-code-compliance

Use it when:: You have an authoritative document, such as a whitepaper, protocol spec or design note, and the code that should implement it.
It does:: Runs its plugin's workflow, which splits the documents into checkable requirements, checks each in its own subagent and has other agents try to refute every divergence.

workflow local claude-code subagents official security verification requirements code-review

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6.2K; bottom 28%
Weekly Downloads: 215; bottom 41%

semgrep-rule-creator

Use it when:: You want a Semgrep rule that catches a specific vulnerability or bug pattern in your code, or enforces a coding standard.
It does:: Reads seven Semgrep and Testing Handbook docs pages, writes the test file first, dumps the AST, writes the rule and reruns semgrep --test until all pass.

workflow local cli official security code-review code-quality semgrep

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6.2K; bottom 28%
Weekly Downloads: 206; bottom 40%

entry-point-analyzer

Use it when:: You're starting a smart contract audit and need to know which functions can change state and who can call them.
It does:: Detects the language, runs Slither's entry-points printer on Solidity if installed, then classifies every externally callable, state-changing function.

workflow none none official security web3 code-review solidity vyper solana move ton cosmwasm slither

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6.1K; bottom 27%
Weekly Downloads: 222; bottom 42%

audit-prep-assistant

Use it when:: An external security review starts in a week or two and you want your codebase ready for the auditors.
It does:: Asks your goals and concerns, runs static analysis, measures coverage, finds dead code, checks scope and build steps, then drafts documentation.

workflow local cli official security docs-writing testing code-quality

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6.1K; bottom 27%
Weekly Downloads: 193; bottom 39%

solana-vulnerability-scanner

Use it when:: You're auditing a Solana program, native Rust or Anchor, before launch or during a review.
It does:: Searches the code for cross-program calls, derived addresses, account deserialization and instruction introspection, and checks each against a checklist.

workflow none none official security web3 code-review solana anchor rust

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 6K; bottom 26%
Weekly Downloads: 175; bottom 35%

guidelines-advisor

Use it when:: You want to know whether a smart contract project follows development best practices, or need advice on its design, upgrades or tests.
It does:: Explores the code, drafts a plain-English system description and diagrams, reviews architecture and implementation across 11 areas, and asks about design choices.

workflow none none official security web3 architecture code-review code-quality solidity slither

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 183; bottom 37%

coverage-analysis

Use it when:: A fuzzer has plateaued, you've changed a harness, or you want to know why some code is never reached.
It does:: Builds a coverage-instrumented binary, replays the fuzzing corpus through it, and generates text or HTML reports with llvm-cov or gcovr.

workflow local cli official testing security c cpp rust

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 181; bottom 36%

token-integration-analyzer

Use it when:: You're building a token, or your protocol accepts arbitrary ERC20 or ERC721 tokens and you need to know which non-standard ones could break it.
It does:: Runs Slither's ERC conformity, summary and property tools on Solidity, reviews composition and owner privileges, and checks 24 weird ERC20 patterns.

workflow none none official security web3 code-review solidity slither

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 183; bottom 37%

firebase-apk-scanner

Use it when:: You're assessing an Android app you're authorized to test and want to know whether its Firebase backend is left open.
It does:: Runs a bundled scanner that decompiles the APK with apktool, pulls out its Firebase config, then probes auth, databases, Storage, Cloud Functions and Remote Config.

tool remote cli official security mobile firebase android

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 186; bottom 38%

constant-time-analysis

Use it when:: You're writing or reviewing signing, encryption, key exchange or key derivation code and worry about timing attacks.
It does:: Runs a bundled analyzer per file that flags divisions, secret-dependent branches, early-exit comparisons, secret-indexed lookups, weak randomness and variable-time encoding, then traces whether a secret reaches each.

tool none cli official security code-review

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 189; bottom 38%

harness-writing

Use it when:: You're writing a first fuzz target, a campaign finds nothing, crashes won't reproduce, or the API needs structured input.
It does:: Picks entry points such as parsers, writes a minimal harness, adds size checks, splits the bytes into typed values, then iterates on coverage, speed and reproducibility.

workflow local cli official testing security c cpp rust

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.8K; bottom 23%
Weekly Downloads: 186; bottom 38%

fuzzing-obstacles

Use it when:: A fuzzer is stuck at checksum, hash or format validation, or the same input behaves differently between runs.
It does:: Finds the blocking check through coverage and code reading, wraps it in a fuzzing-only build flag, measures coverage again, then weighs the false-positive risk.

workflow local cli official testing security c cpp rust

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.7K; bottom 21%
Weekly Downloads: 185; bottom 37%

cosmos-vulnerability-scanner

Use it when:: You're auditing custom x/ modules, IBC integrations or CosmWasm contracts on a Cosmos chain, especially before launch.
It does:: A discovery subagent inventories the chain and its threat model, then three to six scanner subagents check their patterns in parallel, on consensus-critical code only.

workflow local subagents official security web3 code-review cosmos-sdk cosmwasm go

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 174; bottom 34%

semgrep-rule-variant-creator

Use it when:: You have a working Semgrep rule and want the same detection in Go, Java or other languages.
It does:: Runs its plugin's workflow, which for each language judges applicability, writes tests first, translates the rule against the target's AST and fixes it until semgrep --test passes.

workflow local cli subagents official security code-review code-quality semgrep

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 183; bottom 37%

fuzzing-dictionary

Use it when:: You're fuzzing a parser, protocol or file format, or coverage stalls at checks against fixed strings.
It does:: Writes a dictionary file of quoted tokens, filled by asking an LLM or extracting strings from headers, man pages or binaries, and passes it to the fuzzer.

workflow local cli official testing security

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 185; bottom 37%

second-opinion

Use it when:: You want an independent review from another model, through Codex or Antigravity, of your uncommitted changes, a branch diff or one commit.
It does:: Captures the diff once, builds a review prompt with your project instructions and focus, and runs codex exec, agy or gemini on it.

tool none cli account official code-review multi-agent codex antigravity gemini git

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 191; bottom 38%

constant-time-testing

Use it when:: You need to know whether crypto code that handles keys, nonces or passwords leaks them through how long it takes to run.
It does:: Writes a dudect harness that times fixed against random inputs, and if the t-test flags a leak, marks the secrets for Timecop to trace under Valgrind.

workflow local cli official security testing dudect valgrind

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 180; bottom 36%

devcontainer-setup

Use it when:: You want Claude Code to work in an isolated container instead of directly on your machine.
It does:: Reads the project name and languages from package.json, pyproject.toml, Cargo.toml or go.mod, then fills its templates with matching extensions, settings and setup commands.

setup local cli official infrastructure guardrails docker claude vscode

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 181; bottom 36%

dwarf-expert

Use it when:: You're inspecting a binary's or dSYM's debug sections, verifying debug info a compiler produced, answering a DWARF standard question, or writing code that reads DWARF.
It does:: Finds DIEs, the entries describing each function, variable and type, by name, address or attribute, escalating from dwarfdump flags to grep to a pyelftools script.

guidelines none cli official debugging dwarf

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.6K; bottom 19%
Weekly Downloads: 176; bottom 35%

algorand-vulnerability-scanner

Use it when:: You're auditing an Algorand stateful app or smart signature, or checking that fixes for reported Algorand bugs hold.
It does:: Finds TEAL and PyTeal files, runs Trail of Bits' Tealer analyzer if installed, then sweeps all 11 patterns by hand and checks each transaction type's fields.

workflow none none official security web3 code-review algorand pyteal tealer

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.5K; bottom 16%
Weekly Downloads: 175; bottom 35%

ton-vulnerability-scanner

Use it when:: You're auditing FunC contracts on TON, especially Jetton token handlers and code that forwards TON in outgoing messages.
It does:: Greps for boolean-like values, transfer_notification handlers and forward amounts, checks each against a checklist, then reviews message parsing and gas economics by hand.

workflow none none official security web3 code-review ton func

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.5K; bottom 16%
Weekly Downloads: 175; bottom 35%

cairo-vulnerability-scanner

Use it when:: You're auditing a StarkNet contract, an L1-L2 bridge or signature verification code written in Cairo.
It does:: Greps for felt252 arithmetic, checks every L1 handler, signature nonce and bridge path against checklists, then runs Trail of Bits' Caracal analyzer.

workflow none cli official security web3 code-review cairo starknet caracal

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.5K; bottom 16%
Weekly Downloads: 175; bottom 35%

substrate-vulnerability-scanner

Use it when:: You're auditing custom pallets or runtime code for a Polkadot parachain or a standalone Substrate chain.
It does:: Checks each dispatchable for arithmetic, panics, weights, origin and write order, greps pallets for unwrap and raw operators, and runs the benchmarks.

workflow none none official security web3 code-review substrate rust polkadot

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.5K; bottom 16%
Weekly Downloads: 174; bottom 34%

interpreting-culture-index

Use it when:: You have Culture Index survey results, as a PDF or extracted JSON, and want to know what they mean for a person or a team.
It does:: Extracts trait scores from the PDF with its script, then takes on one of 11 tasks, from reading one profile to mediating a conflict.

workflow local cli official personal pdf culture-index

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.5K; bottom 16%
Weekly Downloads: 175; bottom 35%

yara-rule-authoring

Use it when:: You're writing a YARA rule from malware samples, reviewing someone else's, chasing false positives or porting legacy YARA rules to YARA-X.
It does:: Extracts candidate strings with yarGen or FLOSS, discards weak ones, writes the rule with cheap checks first, then lints it and tests it against clean files.

workflow local cli official security code-review yara

Age: 9 months
Stars: 8.1K; #92
Total Downloads: 5.4K; bottom 13%
Weekly Downloads: 187; bottom 38%

skill-improver

Use it when:: A skill you're writing has quality problems and you want them fixed until it passes review, or to resume after the loop escalated.
It does:: Starts the code-improver plugin's background workflow, which alternates the plugin-dev skill-reviewer agent with a fixer agent round after round.

workflow local claude-code subagents official skill-authoring code-review claude

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 5.4K; bottom 13%
Weekly Downloads: 180; bottom 36%

zeroize-audit

Use it when:: You're auditing C, C++ or Rust code that holds keys, passwords, tokens or other secrets and need to know they're wiped after use.
It does:: Runs phases of worker agents: source analysis, compiler IR and assembly comparison across optimization levels, PoC generation and validation, then a report.

workflow local cli subagents official security code-review c cpp rust

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 5.1K; bottom 3%
Weekly Downloads: 186; bottom 38%

let-fate-decide

Use it when:: You'd rather leave a choice between reasonable approaches to chance than answer clarifying questions.
Runs:: On its own after casual replies like "whatever", "idk", "YOLO" or "you pick", and when the agent is about to choose arbitrarily.

tool none cli official planning

Age: 8 months
Stars: 8.1K; #92
Total Downloads: 5K; bottom 2%
Weekly Downloads: 175; bottom 35%

skills Skill collection