agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when discovering possible regressions from a pinned change and its callers before reproduction.
$ npx -y skills add trailofbits/skills --skill hunt-regressions --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/hunt-regressionsContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when discovering possible regressions from a pinned change and its callers before reproduction.
name: hunt-regressions description: Use when discovering possible regressions from a pinned change and its callers before reproduction.
Input: sealed preparation, frozen S0/S1, change context and registry assignment. On retry, include this assignment's prior candidate-ID mapping. The caller supplies these, including for independent use. Follow [project guidance](../../references/evidence.md#project-guidance) before target work.
Proving a known candidate; use reproduction. Discovery cannot confirm findings.
1. Read the [standard](../../docs/regression-definition.md) and [file contract](../../references/evidence.md). Verify preparation; read frozen change messages, PR discussion and security documentation for intent and supported use. 2. Review the entire diff; trace changed behavior through callers to real interfaces. Use frozen sources and supplied context, not later fixes, advisories or other reviews. 3. Record each lead's changed code, previously supported behavior, reachable trigger, proposed new defect, false-positive checks and required proof. Retain supplied leads suggesting old bugs or incomplete fixes for adjudication. Leave PoC construction to reproduction. 4. Reserve each lead's ID through [registry.py](../../scripts/registry.py) `candidate` using its stable hypothesis key and assigned agent handle. Reuse the key on retry. Write candidate files and `hunt.json` with IDs, file mappings, coverage and limitations. An empty list is valid. If blocked, record partial coverage and uninspected areas. Seal the package.
Keep detailed evidence in the sealed package. Return only:
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…