trailofbits

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities…

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges…

Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent. Use when offloading function-, class-, caller-, callee-, call-path-, entrypoint-, or line-focused code tasks to…

Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintainer-approved ones, and spawning review subagents for never-reviewed ones — then…

Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit confusion, decimals or scaling mismatches, WAD/RAY scale errors, or the wrong…

Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.

Use when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.

Use when a local security patch commit needs independent scoped and three-arm proof.

Interviews the user relentlessly about a plan, decision, or idea until every branch of the decision tree is resolved. Use when the user wants to stress-test their thinking, sharpen a plan or design before acting, or uses any 'grill' trigger phrase (e.g.…

Compacts the current conversation into a handoff document so a fresh agent can continue the work in a new session.

Teaches the user a new skill or concept over multiple sessions, using the current directory as a stateful teaching workspace with lessons, learning records, and reference materials.

Reference for writing and editing agent skills well — the vocabulary and principles that make a skill predictable. Consult when authoring, reviewing, or pruning a SKILL.md.

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism,…

Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans,…

Implements file-based planning for complex multi-step tasks. Creates task_plan.md, findings.md, and progress.md as persistent working memory. Use when starting tasks requiring >5 tool calls, multi-phase projects, research, or any work where losing track of…

Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via…

Convert a Claude/Codex SKILL.md into a typed Python recipe under .calcifier/recipe.py. Use when the user asks to "calcify a skill", convert a skill into a recipe, harden a skill into a deterministic pipeline, or pin agent control flow.

Execute a calcified recipe with verbose logging. Use when the user is iterating on a calcifier recipe, wants per-step transcripts, or asks to "debug a calcifier recipe".

Execute a calcified .calcifier/recipe.py pipeline. Use when the user asks to "run a calcified skill", "exec a calcifier recipe", or wants deterministic playback of a pinned skill.

Re-calcify a SKILL.md and unified-diff the result against the on-disk recipe. Use when the user asks to "check calcifier drift", "diff a recipe against its skill", or "update a calcified recipe".

Draft a changelog entry for the changes in a workspace and save it as Markdown.

Summarize the notes in a workspace into a short structured digest.

Describe each item in an inventory and save one record per item.

Convert a Claude/Codex SKILL.md into a typed Python recipe under .calcifier/recipe.py. Use when the user asks to "calcify a skill", convert a skill into a recipe, harden a skill into a deterministic pipeline, or pin agent control flow.

Run the final scope-controlled review before committing, pushing, or opening a PR. Use for closeout review, readiness checks, or self-review of a completed branch.

Review a coop pull request or local diff with independent, self-validated correctness, design, convention, security, API, test, documentation, and comment lenses. Use for PR review, /review follow-up, or when asked to inspect a branch without modifying it.

Triage and shepherd all open PRs owned by the current GitHub user, isolating each writable worker in its own worktree. Use when asked to babysit or monitor the user's PR fleet.

Shepherd the current user's open PR through base updates, CI failures, and review feedback without rewriting history or merging. Use when asked to babysit, monitor, or fix an existing PR.

Run and interpret coop's VM integration suite locally on Lima or remotely on Firecracker. Use when asked for integration testing or when guest-visible/lifecycle work needs its pre-merge gate.

Run cargo-mutants for changed coop logic and keep .cargo/mutants.toml synchronized. Use when logic-dense modules change, before refactors, or when asked to verify mutation coverage.

Run the final scope-controlled review before committing, pushing, or opening a PR.

Run cargo-mutants for changed coop logic and keep .cargo/mutants.toml synchronized.

Apply implementation standards only when a task requires changes to code, tests, dependencies, build configuration, shell scripts, or CI. Do not invoke for diagnosis or advice without code changes, documentation-only work, or chat.

Implement a GitHub issue end to end: research, branch, code, verify, review, push, open a pull request, and update the issue. Use when asked to fix or implement a specific GitHub issue.

Install or update this organization's Codex configuration from repo-local files into the user's Codex home. Use when asked to set up, install, update, bootstrap, or sync this Codex configuration, including the global AGENTS template, config.toml, hooks,…

Discover, evaluate, and optionally merge open Dependabot pull requests with dependency-aware ordering and post-merge verification. Use when asked to process or merge Dependabot PRs for a repository.

Review a specific GitHub pull request, consolidate findings, fix P1-P3 issues, verify the changes, push a fix commit, and post a summary. Use when asked to review and fix a PR by number.

Apply finding hygiene during authorized security audits, vulnerability research, fuzzing, exploit validation, and triage. Do not use for ordinary secure coding, generic code review, or unapproved target testing.

Write or revise durable technical prose such as READMEs, reports, findings, runbooks, design notes, and pull-request descriptions. Do not use for ordinary chat replies or code-only changes.

Debugs the Buttercup CRS (Cyber Reasoning System) running on Kubernetes. Use when diagnosing pod crashes, restart loops, Redis failures, resource pressure, disk saturation, DinD issues, or any service misbehavior in the crs namespace. Covers triage, log…

Buttercup-specific Langfuse wiring. Use when adding LLM tracing to a new LangChain/LangGraph entry point in this repo, attaching tags/metadata to existing chains, troubleshooting "no traces in Langfuse" against this codebase, or touching the Helm/values…

Interact with Langfuse and access its documentation. Use when needing to (1) query or modify Langfuse data programmatically via the CLI — traces, prompts, datasets, scores, sessions, and any other API resource, (2) look up Langfuse documentation, concepts,…

Implements mutation testing support for new programming languages using tree-sitter grammars and the LanguageEngine trait. Triggers on "add language support", "add [language] support", "implement [language]", "new language", or mentions of specific languages…

Guides through implementing mutation testing support for new programming languages using tree-sitter grammars. Use when user asks to add support for a language such as Python, JavaScript, or any programming language, or mentions "add language support" or "new…

Use to audit Necessist results, running Necessist first if needed, and investigate whether passing removals reveal bugs in code or tests, including test-harness bugs that let tests pass without checking intended behavior.

Use git worktrees when running multiple Claude Code instances in parallel for different features - creates isolated workspaces with separate branches and virtual environments

Use for reverse-engineering work through the local `idac` CLI against a live IDA GUI session, an existing `.i64` / `.idb` database, or a binary that IDA can open. Trigger this skill when the task involves decompilation, disassembly, ctree or microcode…

Check whether an app or project needs a Brotli security update for CVE-2026-111497, explain the result in plain language, and give practical next steps. Find bundled copies and investigate whether the running app uses them.