# Trail of Bits

Installed skills you start with a slash command. Each one runs part of an investigation for you.

- [/insecure-defaults:audit](https://www.atlasscope.dev/prompts/insecure-defaults-audit): Finds unsafe defaults: fallback secrets, default passwords, switches that let everything through when they fail, weak encryption, loose access rules and debug details leaking out.
- [/supply-chain-risk-auditor](https://www.atlasscope.dev/prompts/supply-chain-risk-auditor): Checks your direct dependencies and the ones in the lockfile for security warnings, abandoned projects and risky publishers.
- [/agentic-actions-auditor](https://www.atlasscope.dev/prompts/agentic-actions-auditor): Checks GitHub Actions that run Claude, Codex or Gemini for exposed tokens and prompt injection (hidden instructions in issues and PRs that the AI might follow).
- [/differential-review:diff-review](https://www.atlasscope.dev/prompts/differential-review-diff-review): Security review of a set of code changes, using git history and counting how many callers each change could affect.
- [/sharp-edges](https://www.atlasscope.dev/prompts/sharp-edges): Finds APIs that are easy to misuse and configuration options that are dangerous.
- [/variant-analysis](https://www.atlasscope.dev/prompts/variant-analysis): After one bug is found, hunts for the other places with the same root cause.
- [/property-based-testing](https://www.atlasscope.dev/prompts/property-based-testing): Writes and reviews property tests (tests that throw many generated inputs at a rule) with fast-check or Hypothesis.
- [/dimensional-analysis](https://www.atlasscope.dev/prompts/dimensional-analysis): Finds bugs from mixed-up units and decimal scaling by labeling each value with its unit.
- [/spec-to-code-compliance](https://www.atlasscope.dev/prompts/spec-to-code-compliance): Checks code against the document that specifies it, one requirement at a time.
- [/audit-context-building](https://www.atlasscope.dev/prompts/audit-context-building): Reads code one function at a time and records what each one assumes, before any bug hunt starts.
- [/goal-prompt](https://www.atlasscope.dev/prompts/goal-prompt): Drafts /goal commands with a checkable finish line and limits on when to stop.

Source: https://www.atlasscope.dev/prompts/trail-of-bits