trailofbits

Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to…

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive…

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer…

Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and…

Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default:…

Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev…

Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities…

Interviews the user relentlessly about a plan, decision, or idea until every branch of the decision tree is resolved. Use when the user wants to stress-test their thinking, sharpen a plan or design before acting, or uses any 'grill' trigger phrase (e.g.…

Compacts the current conversation into a handoff document so a fresh agent can continue the work in a new session.

Teaches the user a new skill or concept over multiple sessions, using the current directory as a stateful teaching workspace with lessons, learning records, and reference materials.

Reference for writing and editing agent skills well — the vocabulary and principles that make a skill predictable. Consult when authoring, reviewing, or pruning a SKILL.md.

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism,…

Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans,…

Implements file-based planning for complex multi-step tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory. Use when starting tasks requiring >5 tool calls, multi-phase projects, research, or any work where losing track of…

Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via…

Convert a Claude/Codex SKILL.md into a typed Python recipe under .calcifier/recipe.py. Use when the user asks to "calcify a skill", convert a skill into a recipe, harden a skill into a deterministic pipeline, or pin agent control flow.

Execute a calcified recipe with verbose logging. Use when the user is iterating on a calcifier recipe, wants per-step transcripts, or asks to "debug a calcifier recipe".

Execute a calcified .calcifier/recipe.py pipeline. Use when the user asks to "run a calcified skill", "exec a calcifier recipe", or wants deterministic playback of a pinned skill.

Re-calcify a SKILL.md and unified-diff the result against the on-disk recipe. Use when the user asks to "check calcifier drift", "diff a recipe against its skill", or "update a calcified recipe".

Draft a changelog entry for the changes in a workspace and save it as Markdown.

Summarize the notes in a workspace into a short structured digest.

Describe each item in an inventory and save one record per item.

Convert a Claude/Codex SKILL.md into a typed Python recipe under .calcifier/recipe.py. Use when the user asks to "calcify a skill", convert a skill into a recipe, harden a skill into a deterministic pipeline, or pin agent control flow.

Run the final scope-controlled review before committing, pushing, or opening a PR. Use for closeout review, readiness checks, or self-review of a completed branch.

Review a coop pull request or local diff with independent, self-validated correctness, design, convention, security, API, test, documentation, and comment lenses. Use for PR review, /review follow-up, or when asked to inspect a branch without modifying it.

Triage and shepherd all open PRs owned by the current GitHub user, isolating each writable worker in its own worktree. Use when asked to babysit or monitor the user's PR fleet.

Shepherd the current user's open PR through base updates, CI failures, and review feedback without rewriting history or merging. Use when asked to babysit, monitor, or fix an existing PR.

Run and interpret coop's VM integration suite locally on Lima or remotely on Firecracker. Use when asked for integration testing or when guest-visible/lifecycle work needs its pre-merge gate.

Run cargo-mutants for changed coop logic and keep .cargo/mutants.toml synchronized. Use when logic-dense modules change, before refactors, or when asked to verify mutation coverage.

Run the final scope-controlled review before committing, pushing, or opening a PR.

Run cargo-mutants for changed coop logic and keep .cargo/mutants.toml synchronized.

Apply implementation standards only when a task requires changes to code, tests, dependencies, build configuration, shell scripts, or CI. Do not invoke for diagnosis or advice without code changes, documentation-only work, or chat.

Implement a GitHub issue end to end: research, branch, code, verify, review, push, open a pull request, and update the issue. Use when asked to fix or implement a specific GitHub issue.

Install or update this organization's Codex configuration from repo-local files into the user's Codex home. Use when asked to set up, install, update, bootstrap, or sync this Codex configuration, including the global AGENTS template, config.toml, hooks,…

Discover, evaluate, and optionally merge open Dependabot pull requests with dependency-aware ordering and post-merge verification. Use when asked to process or merge Dependabot PRs for a repository.

Review a specific GitHub pull request, consolidate findings, fix P1-P3 issues, verify the changes, push a fix commit, and post a summary. Use when asked to review and fix a PR by number.

Apply finding hygiene during authorized security audits, vulnerability research, fuzzing, exploit validation, and triage. Do not use for ordinary secure coding, generic code review, or unapproved target testing.

Write or revise durable technical prose such as READMEs, reports, findings, runbooks, design notes, and pull-request descriptions. Do not use for ordinary chat replies or code-only changes.

Debugs the Buttercup CRS (Cyber Reasoning System) running on Kubernetes. Use when diagnosing pod crashes, restart loops, Redis failures, resource pressure, disk saturation, DinD issues, or any service misbehavior in the crs namespace. Covers triage, log…

Buttercup-specific Langfuse wiring. Use when adding LLM tracing to a new LangChain/LangGraph entry point in this repo, attaching tags/metadata to existing chains, troubleshooting "no traces in Langfuse" against this codebase, or touching the Helm/values…

Interact with Langfuse and access its documentation. Use when needing to (1) query or modify Langfuse data programmatically via the CLI — traces, prompts, datasets, scores, sessions, and any other API resource, (2) look up Langfuse documentation, concepts,…

Implements mutation testing support for new programming languages using tree-sitter grammars and the LanguageEngine trait. Triggers on "add language support", "add [language] support", "implement [language]", "new language", or mentions of specific languages…

Guides through implementing mutation testing support for new programming languages using tree-sitter grammars. Use when user asks to add support for a language such as Python, JavaScript, or any programming language, or mentions "add language support" or "new…

Use to audit Necessist results, running Necessist first if needed, and investigate whether passing removals reveal bugs in code or tests, including test-harness bugs that let tests pass without checking intended behavior.

Use git worktrees when running multiple Claude Code instances in parallel for different features - creates isolated workspaces with separate branches and virtual environments

Analyze binaries and inspect or edit IDA Pro databases with the local idac CLI. Use for IDA decompilation, xrefs, type or class recovery, and database edits, rather than general RE explanations or source-only work.

Check whether an app or project needs a Brotli security update for CVE-2026-111497, explain the result in plain language, and give practical next steps. Find bundled copies and investigate whether the running app uses them.