agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when pinning before/after sources and collecting PR or commit context for a regression investigation.
$ npx -y skills add trailofbits/skills --skill prepare-regression --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/prepare-regressionContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when pinning before/after sources and collecting PR or commit context for a regression investigation.
name: prepare-regression description: Use when pinning before/after sources and collecting PR or commit context for a regression investigation.
Input: PR URL or repository plus commit/range, and registry assignment. Follow [project guidance](../../references/evidence.md#project-guidance) after resolving the target commit.
The same inputs have a verified preparation record; reuse it.
1. Read the [standard](../../docs/regression-definition.md) and [file contract](../../references/evidence.md). Pin the complete change as S0/S1: commit parent or explicit range baseline; merge base to frozen head for unmerged PRs; merge first parent to merge commit, squash parent to squash, or the complete rebased series for merged PRs. Ambiguous ranges and missing root baselines block preparation. 2. Freeze commit titles/messages or PR title, body, discussion, reviews and inline comments with URLs and collection time. Paginate APIs; record limits and lifecycle. Locate security/threat-model documents in both states; record paths or search limitations. 3. Run [snapshot.py](../../scripts/snapshot.py) via `uv run --no-project` with repository, S0, S1 and a new directory, or equivalent Git commands for special source needs. Preserve dependency/submodule/LFS revisions. Exclude later history; keep exports pristine and build in separate copies. 4. Write and seal `prepare.json` with boundary explanations, frozen context and source artifacts. If blocked, preserve collected evidence and name the prerequisite.
Keep detailed evidence in the sealed package. Return only:
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…