--- title: "Trail of Bits - Air Market" description: "Trail of Bits publishes 59 listings on Air Market. More code: binary lifters @lifting-bits, blockchain @crytic, forks @trail-of-forks" canonical: "https://airmarket.ai/@trailofbits" --- [Air Market](/) / [Creators](/creators) / Trail of Bits Creator # Trail of Bits More code: binary lifters @lifting-bits, blockchain @crytic, forks @trail-of-forks **Trail of Bits on Air Market** | | | | --- | --- | | Listings | 59 | | GitHub | [trailofbits](https://github.com/trailofbits) | **Published listings, with what each one does** | Listing | Kind | What it does | | --- | --- | --- | | [Differential Security Review](/app/differential-review) | Skill | Someone hands you a pull request and you need to know if it makes things less secure. This reviews the change with security in mind, uses t… | | [Modern Python](/app/modern-python) | Skill | Starting a Python project means picking tools before you write anything, and moving an old one means unpicking the tools it already has. Th… | | [Supply Chain Risk Auditor](/app/supply-chain-risk-auditor) | Skill | Your project pulls in code you did not write, and some of it may be unmaintained, controlled by one person, or running scripts the moment y… | | [Secure Workflow Guide](/app/secure-workflow-guide) | Skill | You have contract code and you know it needs a security pass, but not where to start or what order to do things in. This walks you through… | | [Property-Based Testing](/app/property-based-testing) | Skill | Hand-picked test cases only cover what you thought to try. Property tests describe a rule that should hold for every input and then hunt fo… | | [Sharp Edges Analysis](/app/sharp-edges) | Skill | Some code is not wrong, it is just easy to use wrongly - a setting that quietly turns off a protection, a function that fails open. This lo… | | [False Positive Check](/app/fp-check) | Skill | Someone reports a security bug and you do not yet know if it is real. This works through the suspected bug and comes back with a verdict -… | | [Code Maturity Assessor](/app/code-maturity-assessor) | Skill | You have a codebase and no clear sense of how well it holds up. This walks through it across nine areas - things like arithmetic, access co… | | [Variant Analysis](/app/variant-analysis) | Skill | You just found a bug in one file, and now you are wondering if the same mistake was made somewhere else. This helps you go looking for the… | | [gh CLI](/app/gh-cli) | Skill | You point at something on GitHub and get a wall of nothing, because the request went out logged out. This keeps GitHub work going through t… | | [SARIF Parsing Best Practices](/app/sarif-parsing) | Skill | Your scanners produced a big machine-readable results file and now you have to do something with it. This reads those files, filters them,… | | [Semgrep Rule Creator](/app/semgrep-rule-creator) | Skill | You spotted a bad pattern in your code and you don't want to find it by hand again. This writes a rule that scans for it automatically. Rea… | | [Entry Point Analyzer](/app/entry-point-analyzer) | Skill | Before auditing a smart contract you need to know where it can be poked from the outside. This finds the externally callable functions that… | | [Audit Prep Assistant](/app/audit-prep-assistant) | Skill | A security review is coming and the codebase is not in a state anyone wants to hand over. This walks the preparation with Trail of Bits' ch… | | [Solana Vulnerability Scanner](/app/solana-vulnerability-scanner) | Skill | You have a Solana or Anchor program and want to know if it has the well-known holes before someone else finds them. This scans it for a set… | | [Token Integration Analyzer](/app/token-integration-analyzer) | Skill | Tokens often do not behave the way the standard says, and a protocol that assumes they do can break. This looks at a token contract for odd… | | [Firebase APK Security Scanner](/app/firebase-apk-scanner) | Skill | Mobile apps often talk to a cloud backend, and that backend is sometimes left unprotected. This scans an Android app package for those mist… | | [Guidelines Advisor](/app/guidelines-advisor) | Skill | You have smart contract code and you want to know where it is weak before it matters. This reads the codebase and reports back on architect… | | [Coverage Analysis](/app/coverage-analysis) | Skill | You have a fuzzer running but no idea how much of the code it really gets to. This measures which code was exercised during fuzzing. Reach… | | [Writing Fuzzing Harnesses](/app/harness-writing) | Skill | You want to fuzz something, and the hard part is the harness: the small piece of code that hands input to the thing under test. This collec… | | [Cargo Fuzz](/app/cargo-fuzz) | Skill | You have a Rust project and you want to find the inputs that break it. cargo-fuzz is the tool Rust projects using Cargo generally reach for… | | [AddressSanitizer (ASan)](/app/address-sanitizer) | Skill | Fuzzing throws odd input at your program, but a memory bug can happen without the program obviously crashing. AddressSanitizer catches thos… | | [Overcoming Fuzzing Obstacles](/app/fuzzing-obstacles) | Skill | Sometimes a fuzzer stalls because the code rejects everything it sends - a checksum does not match, or leftover state gets in the way. This… | | [Semgrep Rule Variant Creator](/app/semgrep-rule-variant-creator) | Skill | You have a Semgrep rule that works, but your code is not all in one language. Give it the rule and the languages you want, and you get a se… | | [Second Opinion](/app/second-opinion) | Skill | You have changes you are not fully sure about and you want another pair of eyes that is not your own. This sends the code to an outside mod… | | [Fuzzing Dictionary](/app/fuzzing-dictionary) | Skill | A fuzzer throwing random bytes at a parser rarely gets far, because it does not know the words the format uses. A dictionary gives it those… | | [DWARF Expert](/app/dwarf-expert) | Skill | Compiled programs can carry extra information describing the source they came from, and reading it is fiddly. This helps you inspect that i… | | [Constant-Time Testing](/app/constant-time-testing) | Skill | Some cryptographic code gives away secrets by how long it takes to run. That is a timing side channel, and it is hard to spot by reading. T… | | [Algorand Vulnerability Scanner](/app/algorand-vulnerability-scanner) | Skill | You are reviewing an Algorand smart contract and there is a set of mistakes that come up again and again. This checks the contract for thos… | | [Atheris](/app/atheris) | Skill | Fuzzing is usually talked about for C and C++, but Python code has bugs that odd input will find too. Atheris is a coverage-guided fuzzer f… | | [AFL++](/app/aflpp) | Skill | You want to fuzz a C or C++ project and you have more than one processor core sitting idle. AFL++ is a fork of AFL built for that, with ext… | | [OSS-Fuzz](/app/ossfuzz) | Skill | Fuzzing once finds what it finds; fuzzing continuously keeps finding things as the code changes. OSS-Fuzz runs that continuously for open s… | | [TON Vulnerability Scanner](/app/ton-vulnerability-scanner) | Skill | You wrote a contract for TON and want the known dangerous patterns checked. This scans FunC contracts for a small set of critical issues: i… | | [Cairo/StarkNet Vulnerability Scanner](/app/cairo-vulnerability-scanner) | Skill | You are auditing a contract written in Cairo and there is a short list of serious mistakes that keep showing up. This scans for them, inclu… | | [Wycheproof](/app/wycheproof) | Skill | You have written or are reviewing cryptographic code and want to know it holds up against problems people have already found. Wycheproof su… | | [Substrate Vulnerability Scanner](/app/substrate-vulnerability-scanner) | Skill | You are working on a Substrate or Polkadot runtime and want the known dangerous patterns checked before an audit. This scans your pallets f… | | [LibAFL](/app/libafl) | Skill | Sometimes the target you want to fuzz does not fit any ready-made fuzzer, and you need to assemble one yourself. LibAFL is a library made o… | | [Ruzzy](/app/ruzzy) | Skill | Fuzzing tools mostly assume you are working in C or Rust, which leaves Ruby out. Ruzzy is a coverage-guided fuzzer built for Ruby by Trail… | | [Burp Project Parser](/app/burpsuite-project-parser) | Skill | You have a Burp Suite project file full of captured web traffic and you want to find something in it. This lets you search and explore that… | | [Skill Improvement Methodology](/app/skill-improver) | Skill | You wrote a Claude Code skill and it is not quite up to standard. This runs review-and-fix rounds on it, repeating until the issues are gon… | | [Dimensional Analysis Skill](/app/dimensional-analysis) | Skill | Arithmetic bugs often come from mixing values that are not really the same kind of thing, or that are scaled differently. This goes through… | | [Diagramming Code](/app/diagramming-code) | Skill | You are trying to understand how a codebase fits together and reading files one by one is not getting you there. This generates diagrams fr… | | [Trailmark](/app/trailmark) | Skill | On a big or mixed-language codebase it is hard to know what reaches what. This builds a map of how the code connects and lets you ask quest… | | [Crypto Protocol Diagram](/app/crypto-protocol-diagram) | Skill | Protocols are hard to follow when they only exist as source code, a spec document, or prose. This pulls the back-and-forth of messages out… | | [Audit Augmentation](/app/audit-augmentation) | Skill | You have findings from several tools and a picture of how the code fits together, but they live in different places. This lays those findin… | | [Trailmark Structural Analysis](/app/trailmark-structural) | Skill | Sometimes you want the whole structural read on a codebase at once rather than asking one question at a time. This builds the graph, runs t… | | [Mermaid to ProVerif](/app/mermaid-to-proverif) | Skill | You have drawn your cryptographic protocol as a sequence diagram, and now you want to know whether it actually holds up. This turns that di… | | [Genotoxic](/app/genotoxic) | Skill | Mutation testing deliberately breaks your code to see if the tests notice, and the results are a pile of survivors you then have to sort th… | | [Vector Forge](/app/vector-forge) | Skill | You have code implementing a cryptographic algorithm and a set of tests, but no real confidence the tests exercise it. This locates the imp… | | [C/C++ Security Review](/app/c-review) | Skill | You have C or C++ code and need to know whether it can be broken. This reviews it for the classic problems: memory corruption, numbers over… | | [Git Cleanup](/app/git-cleanup) | Skill | Local branches and worktrees pile up and after a while you cannot remember which ones you are done with. This looks at what you have and so… | | [Claude in Chrome MCP Troubleshooting](/app/chrome-mcp-troubleshooting) | Skill | You are trying to use Claude in Chrome and it either fails, says the browser extension is not connected, or behaves strangely. This helps y… | | [Rust Security Review](/app/rust-review) | Skill | Rust protects you until the moment you write unsafe, cross into C, or share state between threads, and then the ordinary guarantees stop. T… | | [Vulnerability Triage Brocards](/app/vulnerability-triage-brocards) | Skill | Security reports arrive faster than anyone can read them, and most of the work is deciding which ones are real. This applies a fixed set of… | | [Open-Sourcing a Repository](/app/open-sourcing) | Skill | You are about to make a private repository public, and the worry is what is sitting in it that should not be. This walks a release-readines… | | [GitHub Triage](/app/github-triage) | Skill | The open issues and pull requests have piled up and nobody has been through them in a while. This goes through the list: merges the ones th… | | [Trailmark Finding Triage](/app/trailmark-finding-triage) | Skill | You have one flagged issue - from a scanner, an annotation, a report, or just a function that looks wrong - and you need to know whether it… | | [Trailmark Variant Neighborhood](/app/trailmark-variant-neighborhood) | Skill | You found one bug. The same mistake is often repeated elsewhere by the same hands or through the same interface. This takes the issue you f… | | [Trailmark Review Gate](/app/trailmark-review-gate) | Skill | A change can look fine line by line and still open something up - a new way in, a check quietly deleted, input now reaching somewhere sensi… | ## Links - [trailofbits.com](https://www.trailofbits.com/) - [X](https://x.com/trailofbits) - [GitHub](https://github.com/trailofbits) --- Canonical URL: