Latest Agent Skills

Open, create, read, analyze, edit, or validate Excel/spreadsheet files (.xlsx, .xlsm, .csv, .tsv) using XML-level manipulation for zero format loss.

Creates, edits, and formats DOCX documents using OpenXML SDK (.NET) with CLI tools and C# scripts, supporting creation, content editing, and template application.

Builds production-ready frontend pages with premium UI design, cinematic animations, AI-generated media assets, persuasive copywriting, and generative art.

Generate, fill, or reformat PDFs with a token-based design system that adapts typography, color, and layout to document type.

Build cross-platform Flutter apps with proven patterns for widgets, state management (Riverpod/Bloc), GoRouter navigation, performance optimization, and testing.

Gives your Claude Code pet a unique singing voice based on its personality, generating music with MiniMax's API and playing it back.

Create real-time GLSL shader effects including ray marching, SDF modeling, fluid simulation, particle systems, procedural generation, and post-processing with 36 documented techniques.

Deploy and manage projects on Vercel using token-based authentication, without interactive login.

Add smooth, native-feeling page transitions and animations to React apps using the browser's View Transition API, with support for shared elements, enter/exit animations, and directional navigation.

Review UI code for compliance with web interface guidelines, including accessibility and UX best practices.

Optimize React and Next.js applications with 70 performance rules across 8 categories, prioritized by impact for automated refactoring and code generation.

Provides React composition patterns to avoid boolean prop proliferation, build flexible component libraries, and design reusable APIs, including React 19 changes.

Build performant React Native and Expo mobile apps with best practices for list performance, animations, navigation, UI patterns, state management, and monorepo configuration.

Review documentation and prose for compliance with writing guidelines, checking style, voice, and tone against a fetched rule set.

Deploy applications and websites to Vercel as preview or production deployments, with support for git-based workflows, CLI authentication, and no-auth fallback.

Audits Vercel projects for cost and performance optimization by collecting metrics, scanning code, and producing ranked recommendations grounded in data.

Clarify requirements before implementing by asking targeted questions when a request has multiple plausible interpretations or key details are unclear.

Diagnose and fix connectivity issues with the Claude in Chrome MCP extension, including native host conflicts between Claude.app and Claude Code CLI.

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues.

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities such as chain halts, fund loss, and state divergence.

Scans Cairo/StarkNet smart contracts for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, and signature replay. Use when auditing StarkNet projects.

Analyzes token implementations and integrations for ERC20/ERC721 conformity, weird token patterns, contract composition, owner privileges, and on-chain scarcity.

Audits project dependencies for supply chain risks including single maintainers, unmaintained packages, low popularity, high-risk features, past CVEs, and missing security contacts.

Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.

Generates Claude Code skills from the Trail of Bits Testing Handbook for security testing tools and techniques.

Searches and extracts data from Burp Suite project files (.burp) using the burpsuite-project-file-parser extension, enabling regex searches on response headers and bodies, extraction of security audit findings, and analysis of proxy history and site map data.

Assesses codebase maturity using Trail of Bits' 9-category framework, producing a professional scorecard with evidence-based ratings and actionable recommendations.

Guides the design and structuring of workflow-based Claude Code skills with multi-step phases, decision trees, subagent delegation, and progressive disclosure.

Verifies that blockchain code implements exactly what documentation specifies, identifying gaps between specs and implementation for audit engagements.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Detect timing side channels in cryptographic code using formal, symbolic, dynamic, and statistical testing tools.

Provides guidance for property-based testing across multiple languages and smart contracts, helping detect patterns where PBT offers stronger coverage than example-based tests.

Analyzes cryptographic code to detect operations that leak secret data through execution timing variations, supporting multiple languages.

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

Analyzes smart contract codebases against Trail of Bits' secure development guidelines, generating documentation, reviewing architecture and upgradeability patterns, assessing implementation quality, identifying pitfalls, and providing prioritized recommendations.

Guides fuzzers with domain-specific tokens to reach deeper code paths in parsers, protocol handlers, and file format processors.

Patch code to bypass checksums, global state, and validation checks that block fuzzer progress, using conditional compilation for C/C++ and Rust.

Measures code coverage during fuzzing to assess harness effectiveness and identify fuzzing blockers.

Detect memory errors like buffer overflows and use-after-free bugs in C/C++ code during fuzzing and testing using AddressSanitizer.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

Identifies state-changing entry points in smart contract codebases for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

Orchestrates a dimensional-analysis pipeline to annotate codebases with unit/dimension comments, discover dimensional vocabulary, and detect arithmetic bugs from unit mismatches or precision loss.

Interprets Culture Index survey data, behavioral profiles, and personality assessments from JSON or PDF. Supports individual profile interpretation, team composition analysis, burnout detection, hiring profiles, manager coaching, interview transcript analysis, and conflict mediation.

Write effective fuzzing harnesses across languages to improve code coverage and find bugs in your system under test.

Performs security-focused differential review of code changes (PRs, commits, diffs), adapting analysis depth to codebase size and generating comprehensive markdown reports.

Generates minimal macOS Seatbelt sandbox configurations to isolate and restrict applications with allowlist-based profiles.

Creates pre-configured devcontainers with Claude Code, language-specific tooling (Python, Node, Rust, Go), and persistent volumes for isolated development environments.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.

Validate cryptographic implementations against known attacks and edge cases using Wycheproof test vectors.

Fuzz Rust projects with libFuzzer using cargo-fuzz, including harness writing, sanitizer integration, and coverage analysis.

Find similar vulnerabilities and bugs across codebases using pattern-based analysis after identifying an initial issue.

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, or formal models (ProVerif/Tamarin) and generates Mermaid sequence diagrams with cryptographic annotations.

Coverage-guided fuzzer built into LLVM for C/C++ projects. Use for fuzzing C/C++ code that can be compiled with Clang.