Audit-Context-Building
Map an unfamiliar codebase before vulnerability hunting, documenting function assumptions, guarantees, dependencies, and unresolved questions for the later analysis.
Trail of Bits
Explore Trail of Bits security research, analysis tools, and Agent Skills for understanding code, reviewing changes, and testing invariants. Compare its instruction-based workflows with static analysis and smart-contract fuzzing projects to plan a more evidence-focused software review.
About Trail of Bits
Trail of Bits is a security research and engineering organization whose public work includes assessments, technical research, educational resources, and software tools. Its projects address different parts of software assurance, from understanding complex code to finding concrete failures and documenting how a finding can be reproduced.
The Skills collection organizes AI-assisted workflows such as audit context building, differential review, and property-based testing. These instructions separate understanding a system from judging a vulnerability, and encourage explicit evidence for the work performed. They are methods for guiding an agent, rather than executable replacements for an analysis tool.
Independent software projects include Slither and Echidna in the Crytic blockchain-security organization, which Trail of Bits identifies as part of its public work. Slither analyzes contract code, while Echidna explores generated executions against properties. The Skills repository uses CC-BY-SA-4.0; individual software projects have their own licenses and installation requirements.
Selected Trail of Bits Skills
Explore Trail of Bits Skills for building code context, assessing security-sensitive changes, and designing property-based tests. Compare their inputs and expected outcomes to choose a workflow that fits the code and question being investigated.
Differential-Review
Review commits and pull-request changes for security impact, using history, affected callers, test coverage, and explicit evidence to structure the assessment.
Property-Based-Testing
Design and review property-based tests for meaningful invariants, roundtrips, and other rules, then investigate whether counterexamples expose implementation or test errors.
Trail of Bits Open-Source Projects
Explore Trail of Bits software tools for smart-contract analysis and testing. Compare static detectors with property-driven execution, including the evidence each can produce and the project setup needed to use them effectively.
Slither
Analyze Solidity and Vyper contracts with vulnerability detectors, code information reports, and a Python API for building custom static analyses.
Echidna
Test Ethereum contracts with generated transaction sequences that search for counterexamples to user-defined properties and invariants during execution.
More Teams and Creators
Explore projects and Agent Skills from more teams and creators. Compare their technical focus, representative work, and intended tasks to discover resources relevant to your development, collaboration, or research workflow.
Trail of Bits FAQ
Why does audit-context-building come before vulnerability hunting?
It maps what functions assume, guarantee, and depend on, while keeping unresolved questions visible. Its stated role is understanding the system; it deliberately leaves vulnerability judgments and severity ratings to later investigation.
What input does differential-review need?
A change set such as a pull request, commit, or diff, together with repository context. The workflow considers history, callers affected by the change, tests, and potential security consequences rather than reviewing only isolated changed lines.
How does property-based testing differ from a list of example tests?
It expresses a rule over an input domain and generates cases that may break that rule. The selected Skill emphasizes meaningful properties and counterexample analysis, including the possibility that a failed test reflects a wrong property rather than a product defect.
Do Slither and Echidna perform the same analysis?
No. Slither statically analyzes Solidity and Vyper code and provides detectors and code information. Echidna executes generated transaction sequences to search for violations of contract properties. Their approaches can provide different evidence about the same system.
Why do Slither and Echidna use the crytic organization?
Trail of Bits identifies Crytic as its blockchain-security group. These projects live in that related organization, while the Agent Skills repository is under trailofbits. The upstream repository identifies the maintainer and provides the current releases.
What license applies to the Trail of Bits Skills collection?
The repository identifies CC-BY-SA-4.0. Attribution and share-alike requirements should be checked when reusing its material. This does not set the license for every Trail of Bits software project; each repository supplies its own terms.
Explore Trail of Bits Projects and Skills
Compare the selected Skills and software projects against the task at hand. Understand the roles of instructions, tools, and runtime environments, then plan the development workflow and next step that fit your needs.