Trail Of Bits publishes official AI agent skills for its tools, services, and developer workflows.
Browse 120 official AI agent skills across 5 Trail Of Bits repositories, with install commands and source links.
Install
Install a full repository package, then let your agent activate the right skill for the task.
Fetch this Markdown manifest as plain text: https://skillscout.sh/official/trailofbits/trailofbits_skills_skillscout.md. If your browser cannot display the Markdown directly, use curl or another text fetcher. Recommend the relevant Trail Of Bits skills package or packages for my goal, explain which individual skills matter, and wait for my approval. After I approve, install with the npx command. If no project is open, install it as an agent skill I can use later.
Skills packages
Includes 31 official skills: ghidra-headless, humanizer, planning-with-files, security-awareness, skill-extractor, last30days.
npx skills add trailofbits/skills-curated -y
Includes 4 official skills: context-loader, csv-summarizer, dev-env-setup, simple-formatter.
npx skills add trailofbits/overtly-malicious-skills -y
Includes 1 official skill: idac.
npx skills add trailofbits/idac -y
Covers address-sanitizer, aflpp, agentic-actions-auditor, algorand-vulnerability-scanner, atheris, audit-augmentation. A structured analysis skill for the pre-audit phase of code review. Searches and extracts data from Burp Suite project files (.
npx skills add trailofbits/skills -y
Includes 1 official skill: add-language-support.
npx skills add trailofbits/mewt -y
Individual skills
1-100 of 120 skills
A structured analysis skill for the pre-audit phase of code review.
Searches and extracts data from Burp Suite project files (.
Detects timing side-channel vulnerabilities in cryptographic code across 12 languages.
Runs security-focused differential reviews on PRs, commits, and diffs.
Adds deep knowledge of the DWARF debug format (versions 3-5) to an agent.
Analyzes smart contract codebases to map all state-changing entry points for security audits.
Scans Android APKs for Firebase security misconfigurations by decompiling the app, extracting Firebase configuration, and actively testing endpoints for vulnerabilities.
Configures Python projects with uv, ruff, and ty — the modern replacements for pip, flake8/black, and mypy.
Guides property-based testing across Python, JavaScript, Rust, and Solidity/Vyper.
Creates custom Semgrep rules for detecting security vulnerabilities and code patterns.
Takes an existing Semgrep rule and ports it to one or more target languages.
Evaluates whether APIs, configurations, and interfaces are resistant to developer misuse.
Repository documentation
Includes 31 official skills: ghidra-headless, humanizer, planning-with-files, security-awareness, skill-extractor, last30days.
Install the full package:
npx skills add trailofbits/skills-curated -yInstall a specific skill:
npx skills add trailofbits/skills-curated@ghidra-headless -yUse the package when you want your agent to choose the relevant skill from this official Trail Of Bits repository.
View trailofbits/skills-curated on GitHub