Skill UI

Prepares codebases for Trail of Bits security reviews by setting goals, running static analysis, expanding test coverage, pruning dead code, documenting build scope/access, and generating flowcharts, user stories, glossaries, and other reviewer-ready artifacts.

Prepares codebases for Trail of Bits security reviews by setting goals, running static analysis, expanding test coverage, pruning dead code, documenting build scope/access, and generating flowcharts, user stories, glossaries, and other reviewer-ready artifacts.

A specialized skill for writing highly efficient, memory-safe, and robust C code. This guide focuses on best practices for systems programming, including rigorous memory management (malloc/free), advanced pointer arithmetic, POSIX compliance, multi-threading (pthreads), and embedded systems constraints. It emphasizes using static analysis tools, implementing comprehensive error handling, and ensuring performance through proper profiling. Ideal for complex, low-level system tasks.

An expert AI specialist that integrates advanced static analysis (e.g., CodeQL, SonarQube) with modern DevOps practices. It performs multi-layered code reviews, checking for security vulnerabilities, performance bottlenecks, architectural flaws, and adherence to best practices across various languages. Ideal for CI/CD pipelines and pull request validation.

Guides engineers through initializing MCUs, crafting RTOS-aware drivers, and tuning power/timing for STM32, ESP32, and bare-metal targets; covers constraint analysis, interrupt safety, resource tracking, and validation with static analysis and real-time debugging.

This skill acts as a comprehensive security scanner specializing in detecting Cross-Site Scripting (XSS) vulnerabilities in client-side code. It performs static analysis across React, Vue, Angular, and vanilla JavaScript, specifically identifying unsafe practices like direct HTML manipulation (innerHTML), raw rendering (v-html), and insecure URL handling. Use it when auditing frontend code for security flaws and needing best practices for secure coding.

A mandatory workflow for ensuring high code quality across multiple ecosystems, including Node.js/TypeScript and Python. This pipeline runs static analysis tools—such as linters, type checkers (MyPy, tsc), and security scanners (Bandit)—after every code change. It mandates that no task is considered 'done' or committed until all validation checks pass, resolving style, syntax, and type mismatches.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

A comprehensive specialist that combines automated static analysis (SonarQube, CodeQL, Semgrep) with advanced AI capabilities. This tool performs multi-layered code reviews assessing security vulnerabilities, performance bottlenecks, architectural coherence, and maintainability across various programming languages, integrating seamlessly into CI/CD pipelines.

This skill provides a comprehensive, expert guide to the entire reverse engineering lifecycle. It covers advanced techniques for binary analysis, including static analysis (disassembly, metadata extraction, control flow mapping) and dynamic analysis (API hooking, memory tracing). Mastery includes utilizing industry-leading tools such as IDA Pro, Ghidra, radare2, and specialized frameworks like pwntools and angr. The methodology is structured for secure research, CTF challenges, and vulnerability assessment, emphasizing best practices and ethical use.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.