floatboat
Open navigation menu

Trail of Bits

Explore Trail of Bits security research, analysis tools, and Agent Skills for understanding code, reviewing changes, and testing invariants. Compare its instruction-based workflows with static analysis and smart-contract fuzzing projects to plan a more evidence-focused software review.

About Trail of Bits

Trail of Bits is a security research and engineering organization whose public work includes assessments, technical research, educational resources, and software tools. Its projects address different parts of software assurance, from understanding complex code to finding concrete failures and documenting how a finding can be reproduced.

The Skills collection organizes AI-assisted workflows such as audit context building, differential review, and property-based testing. These instructions separate understanding a system from judging a vulnerability, and encourage explicit evidence for the work performed. They are methods for guiding an agent, rather than executable replacements for an analysis tool.

Independent software projects include Slither and Echidna in the Crytic blockchain-security organization, which Trail of Bits identifies as part of its public work. Slither analyzes contract code, while Echidna explores generated executions against properties. The Skills repository uses CC-BY-SA-4.0; individual software projects have their own licenses and installation requirements.

More Teams and Creators

Explore projects and Agent Skills from more teams and creators. Compare their technical focus, representative work, and intended tasks to discover resources relevant to your development, collaboration, or research workflow.

Trail of Bits FAQ

Why does audit-context-building come before vulnerability hunting?
It maps what functions assume, guarantee, and depend on, while keeping unresolved questions visible. Its stated role is understanding the system; it deliberately leaves vulnerability judgments and severity ratings to later investigation.
What input does differential-review need?
A change set such as a pull request, commit, or diff, together with repository context. The workflow considers history, callers affected by the change, tests, and potential security consequences rather than reviewing only isolated changed lines.
How does property-based testing differ from a list of example tests?
It expresses a rule over an input domain and generates cases that may break that rule. The selected Skill emphasizes meaningful properties and counterexample analysis, including the possibility that a failed test reflects a wrong property rather than a product defect.
Do Slither and Echidna perform the same analysis?
No. Slither statically analyzes Solidity and Vyper code and provides detectors and code information. Echidna executes generated transaction sequences to search for violations of contract properties. Their approaches can provide different evidence about the same system.
Why do Slither and Echidna use the crytic organization?
Trail of Bits identifies Crytic as its blockchain-security group. These projects live in that related organization, while the Agent Skills repository is under trailofbits. The upstream repository identifies the maintainer and provides the current releases.
What license applies to the Trail of Bits Skills collection?
The repository identifies CC-BY-SA-4.0. Attribution and share-alike requirements should be checked when reusing its material. This does not set the license for every Trail of Bits software project; each repository supplies its own terms.

Find the Original Security Review Tools

Check the official organization for the relevant tool or instruction before assigning an audit task.

Visit Trail of Bits on GitHub