Browse Skills

Dimensional Analysis annotates codebases with unit and dimension comments, then propagates and validates them to catch formula bugs early. Use when auditing DeFi protocols, blockchain code, or other arithmetic-heavy code.

DWARF Expert analyzes DWARF debug information in compiled binaries. Use it when inspecting .debug_* sections, verifying debug info integrity, or writing code that parses DWARF.

Entry Point Analyzer identifies state-changing entry points in smart contract codebases for security auditing. Use it to map attack surfaces, classify access control, and generate structured audit reports for Solidity, Vyper, Solana, Move, TON, and CosmWasm.

False Positive Check systematically verifies suspected security bugs to determine if they are true positives or false positives, producing documented evidence for each verdict. Use it when asked to confirm whether a specific finding is real or exploitable.

Firebase APK Scanner scans Android APKs for Firebase security misconfigurations, including open databases, storage buckets, authentication issues, and exposed cloud functions. Use it during authorized mobile app security audits or Firebase endpoint testing.

Guidelines Advisor analyzes smart contract codebases based on Trail of Bits' best practices to generate documentation, review architecture, upgradeability, implementation quality, dependencies, and testing. It provides prioritized actionable recommendations for developers improving contract security.

Secure Workflow Guide walks through Trail of Bits' 5-step secure development workflow for smart contracts, running Slither scans, checking upgradeability and ERC conformance, generating security diagrams, documenting properties for fuzzing, and reviewing manual security areas.

Solana Vulnerability Scanner scans Solana programs (native Rust and Anchor) for six critical vulnerability patterns such as arbitrary CPI, improper PDA validation, and missing signer/ownership checks. Use it when auditing or reviewing Solana smart contracts before deployment.

Substrate Vulnerability Scanner scans Substrate/Polkadot pallets for seven critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Token Integration Analyzer analyzes token implementations and integrations against Trail of Bits' token integration checklist. Use it to check ERC20/ERC721 conformity, weird token patterns, owner privileges, and on-chain scarcity.

TON Vulnerability Scanner scans TON smart contracts written in FunC for critical vulnerabilities such as integer-as-boolean misuse, fake Jetton contracts, and improper gas handling. Use it when auditing or reviewing TON dApps for security issues before launch.

EOL Readiness Advisor runs a go/no-go assessment for retiring a product or feature, then right-sizes the effort. Use it when someone says "we should probably kill this" and nobody has made the call.