| ask-questions-if-underspecified | Clarify ambiguous requirements by asking questions before implementing. Only when invoked explicitly. | — | ./plugins/ask-questions-if-underspecified |
| audit-context-building | Build deep architectural context through ultra-granular code analysis before vulnerability hunting | — | ./plugins/audit-context-building |
| building-secure-contracts | Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants. | — | ./plugins/building-secure-contracts |
| burpsuite-project-parser | Search and extract data from Burp Suite project files (.burp) for security analysis | — | ./plugins/burpsuite-project-parser |
| claude-in-chrome-troubleshooting | Diagnose and fix Claude in Chrome MCP extension connectivity issues | — | ./plugins/claude-in-chrome-troubleshooting |
| constant-time-analysis | Detect compiler-induced timing side-channels in cryptographic code | — | ./plugins/constant-time-analysis |
| culture-index | Interprets Culture Index survey results for individuals and teams | — | ./plugins/culture-index |
| debug-buttercup | Debug Buttercup Kubernetes deployments | — | ./plugins/debug-buttercup |
| devcontainer-setup | Create pre-configured devcontainers with Claude Code and language-specific tooling | — | ./plugins/devcontainer-setup |
| differential-review | Security-focused differential review of code changes with git history analysis and blast radius estimation | — | ./plugins/differential-review |
| firebase-apk-scanner | Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only. | — | ./plugins/firebase-apk-scanner |
| gh-cli | Intercepts GitHub URL fetches and curl/wget commands, redirecting to the authenticated gh CLI. | — | ./plugins/gh-cli |
| dwarf-expert | Interact with and understand the DWARF debugging format | — | ./plugins/dwarf-expert |
| entry-point-analyzer | Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports. | — | ./plugins/entry-point-analyzer |
| mutation-testing | Configures mewt or muton mutation testing campaigns — scopes targets, tunes timeouts, and optimizes long-running runs. Use when the user mentions mewt, muton, mutation testing, or wants to configure or optimize a mutation testing campaign. | — | ./plugins/mutation-testing |
| property-based-testing | Property-based testing guidance for multiple languages and smart contracts | — | ./plugins/property-based-testing |
| semgrep-rule-creator | Create custom Semgrep rules for detecting bug patterns and security vulnerabilities | — | ./plugins/semgrep-rule-creator |
| semgrep-rule-variant-creator | Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation | — | ./plugins/semgrep-rule-variant-creator |
| sharp-edges | Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes | — | ./plugins/sharp-edges |
| static-analysis | Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection | — | ./plugins/static-analysis |
| spec-to-code-compliance | Specification-to-code compliance checker for blockchain audits with evidence-based alignment analysis | — | ./plugins/spec-to-code-compliance |
| testing-handbook-skills | Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide) | — | ./plugins/testing-handbook-skills |
| trailmark | Builds multi-language source and binary code graphs for security analysis: call graphs, attack surface mapping, blast radius, taint propagation, complexity hotspots, entry point enumeration, proxy/unresolved-call tracking, type/reference analysis, and structural diffs. Creates bounded, graph-informed source packets for delegating focused work to constrained subagents. Generates Mermaid diagrams, runs graph-informed mutation testing triage (genotoxic), generates mutation-driven test vectors (vector-forge), extracts crypto protocol message flows, converts Mermaid diagrams to ProVerif models, projects SARIF/weAudit/binary findings onto code graphs, triages single findings with graph evidence, gates branch diffs for structural review regressions, and expands seed findings into variant-neighborhood candidates. Use when analyzing call paths, slicing source context for smaller models, mapping attack surface, visualizing code architecture, triaging survived mutants, generating cryptographic test vectors, diagramming crypto protocols, formally verifying protocols, augmenting audits with static analysis findings, deciding whether one candidate issue is reachable, reviewing graph-level PR risk, or seeding variant analysis. | — | ./plugins/trailmark |
| variant-analysis | Find similar vulnerabilities and bugs across codebases using pattern-based analysis | — | ./plugins/variant-analysis |
| c-review | Comprehensive C/C++ security code review with specialized bug-finding agents covering memory safety, type safety, concurrency, and Linux/Windows userspace-specific issues | — | ./plugins/c-review |
| rust-review | Comprehensive Rust security code review with specialized bug-finding agents covering the safe/unsafe boundary, memory safety in unsafe blocks, concurrency, panic-induced DoS, recursion-induced stack overflow, FFI, and async runtime hazards | — | ./plugins/rust-review |
| modern-python | Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools. | — | ./plugins/modern-python |
| insecure-defaults | Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production | — | ./plugins/insecure-defaults |
| second-opinion | Runs code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles Codex's built-in MCP server for direct tool access. | — | ./plugins/second-opinion |
| yara-authoring | YARA-X detection rule authoring with linting and quality analysis | — | ./plugins/yara-authoring |
| git-cleanup | Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work. | — | ./plugins/git-cleanup |
| seatbelt-sandboxer | Generate minimal macOS Seatbelt sandbox configurations for applications | — | ./plugins/seatbelt-sandboxer |
| supply-chain-risk-auditor | Audit supply-chain threat landscape of project dependencies for exploitation or takeover risk | — | ./plugins/supply-chain-risk-auditor |
| zeroize-audit | Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis | — | ./plugins/zeroize-audit |
| let-fate-decide | Draws the 12 Houses of the Zodiac Tarot spread using cryptographic randomness to add 100+ bits of entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous. | — | ./plugins/let-fate-decide |
| agentic-actions-auditor | Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference) | — | ./plugins/agentic-actions-auditor |
| skill-improver | Automatically reviews and fixes Claude Code skills through iterative refinement until they meet quality standards. Requires plugin-dev plugin. | — | ./plugins/skill-improver |
| fp-check | Systematic false positive verification for security bug analysis with mandatory gate reviews | — | ./plugins/fp-check |
| dimensional-analysis | Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol. Prevents dimensional mismatches and catches formula bugs early. | — | ./plugins/dimensional-analysis |
| vulnerability-triage-brocards | Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis. | — | ./plugins/vulnerability-triage-brocards |
| github-triage | Triages a repository's open GitHub issues and pull requests via the gh CLI: optionally merges ready bot and maintainer-approved PRs and spawns review subagents for unreviewed ones, closes already-resolved issues with referenced explanations, cross-links issues with pending fix PRs, and assigns local-only priority and change-size estimates. | — | ./plugins/github-triage |
| open-sourcing | Prepares a repository for public open-source release: secrets-history hygiene, license selection, documentation and CI readiness checks, and language-specific packaging and release guidance. | — | ./plugins/open-sourcing |