Engineering commands
Trail of Bits
Installed skills you start with a slash command. Each one runs part of an investigation for you.
- /insecure-defaults:auditCommandFinds unsafe defaults: fallback secrets, default passwords, switches that let everything through when they fail, weak encryption, loose access rules and debug details leaking out.
- /supply-chain-risk-auditorCommandChecks your direct dependencies and the ones in the lockfile for security warnings, abandoned projects and risky publishers.
- /agentic-actions-auditorCommandChecks GitHub Actions that run Claude, Codex or Gemini for exposed tokens and prompt injection (hidden instructions in issues and PRs that the AI might follow).
- /differential-review:diff-reviewCommandSecurity review of a set of code changes, using git history and counting how many callers each change could affect.
- /sharp-edgesCommandFinds APIs that are easy to misuse and configuration options that are dangerous.
- /variant-analysisCommandAfter one bug is found, hunts for the other places with the same root cause.
- /property-based-testingCommandWrites and reviews property tests (tests that throw many generated inputs at a rule) with fast-check or Hypothesis.
- /dimensional-analysisCommandFinds bugs from mixed-up units and decimal scaling by labeling each value with its unit.
- /spec-to-code-complianceCommandChecks code against the document that specifies it, one requirement at a time.
- /audit-context-buildingCommandReads code one function at a time and records what each one assumes, before any bug hunt starts.
- /goal-promptCommandDrafts /goal commands with a checkable finish line and limits on when to stop.