Owner

trailofbits

42 indexed repositories · View on GitHub

algo
Set up a personal VPN in the cloud

Python · 30387 stars
skills
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

Python · 7164 stars
graphtage
A semantic diff utility and library for tree-like files such as JSON, JSON5, XML, HTML, YAML, and CSV.

Python · 2486 stars
claude-code-config
Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits

Shell · 2114 stars
buttercup
Buttercup finds and patches software vulnerabilities

Python · 1704 stars
claude-code-devcontainer
Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

Shell · 943 stars
pe-parse
Principled, lightweight C/C++ PE parser

C++ · 911 stars
fickling
A Python pickling decompiler and static analyzer

Python · 670 stars
dylint
Run Rust lints from dynamic libraries

Rust · 661 stars
skills-curated
Curated, community-vetted Claude Code plugin marketplace

Python · 504 stars
trailmark
Build and query a graph database representation of source code

C · 487 stars
it-depends
A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

Python · 413 stars
polyfile
A pure Python cleanroom implementation of libmagic, with instrumented parsing from Kaitai struct and an interactive hex viewer

Python · 390 stars
CoBRA
Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation

C++ · 343 stars
mishegos
A differential fuzzer for x86 decoders

C++ · 275 stars
vscode-weaudit
Create code bookmarks and code highlights with a click.

TypeScript · 245 stars
coop
Isolated VM environment for running Claude Code and Codex

Rust · 243 stars
test-fuzz
To make fuzzing Rust easy

Rust · 208 stars
mquire
Zero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug...

Rust · 185 stars
necessist
A mutation-based tool for finding bugs in tests

Rust · 145 stars
22 more repositories live on View on GitHub

Beginner friendly Everything

Open All

A level 0 message reached through use or indirect gets a space where libmagic emits a separator Open

bug

trailofbits/polyfile#3603 · 1 comment · 1 assignee · Opened Sep 18, 2026
A w or W string match reports an extent that runs past the end of the file Open

bug

trailofbits/polyfile#3600 · 1 assignee · Opened Sep 18, 2026
Terminal ChatGPT login reuses desktop daemon outside the unlocked keyring session Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

trailofbits/coop#481 · Opened Sep 15, 2026
Support desktop Remote SSH discovery and guest keyring authentication Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/coop#480 · Opened Sep 15, 2026
Research Firecracker jailer integration and VMM privilege reduction Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

trailofbits/coop#479 · Opened Sep 15, 2026
Research virtualization dependency freshness and update visibility Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/coop#478 · Opened Sep 15, 2026
Research whether the Firecracker vsock device is needed Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

trailofbits/coop#477 · Opened Sep 15, 2026
Track reviewed rustls update for RUSTSEC-2026-0285 Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/coop#476 · Opened Sep 15, 2026
Run Linux image provisioning inside a Firecracker builder VM Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/coop#474 · Opened Sep 14, 2026
Creating a `dylint.toml` does not cause lints to rerun Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

trailofbits/dylint#2079 · Opened Sep 13, 2026
`--env-set` has been removed from rustc, breaking `DYLINT_UNTRACKED_STATE` Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/dylint#2078 · Opened Sep 13, 2026
The patched gentoo definition cannot be loaded by libmagic, so magic_defs is no longer a valid magic source Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

trailofbits/polyfile#3586 · Opened Sep 12, 2026
Analyzer.sbud() returns a truncated tree unless the caller materializes the matches first Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 74/100

trailofbits/polyfile#3584 · Opened Sep 12, 2026
Settle and document the public Python API before 1.0 Open

documentation

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/polyfile#3577 · Opened Sep 12, 2026
Catalogue: libmagic flag and parser divergences with no shipped-definition exposure Open

bug

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/polyfile#3576 · Opened Sep 12, 2026
CSV verdicts name the dialect instead of the encoding, and only ASCII and UTF-8 CSV is recognized Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 68/100

trailofbits/polyfile#3554 · Opened Sep 11, 2026
Text tests run against the file's bytes for every non-UCS encoding, where libmagic uses its decoded buffer Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

trailofbits/polyfile#3551 · 1 comment · Opened Sep 11, 2026
Regex tests run on a backtracking engine, so a safe libmagic definition can hang PolyFile Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/polyfile#3547 · Opened Sep 11, 2026
No equivalent of libmagic's readcdf, so an HWP 5.0 document keeps the OLE 2 prefix Open

claude-code-assisted enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/polyfile#3535 · Opened Sep 11, 2026
Cut the v0.6.0 release Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

trailofbits/polyfile#3533 · 2 comments · Opened Sep 11, 2026
Implement all-offsets scanning for embedded file detection Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/polyfile#3532 · Opened Sep 11, 2026
`SOURCE_FILES` is never invalidated, so spans can be resolved against stale contents Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

trailofbits/necessist#1963 · Opened Sep 11, 2026
Separate stored GitHub PAT identity, VM assignments, and repository defaults Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

trailofbits/coop#469 · Opened Sep 11, 2026
cargo dylint --all exits 0 when it resolves no libraries Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

trailofbits/dylint#2073 · 2 comments · Opened Sep 10, 2026
Diffing XML or HTML to any non-XML output format crashes Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 72/100

trailofbits/graphtage#187 · Opened Sep 9, 2026
XML formatter drops inserted attributes and child elements Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

trailofbits/graphtage#186 · Opened Sep 9, 2026
Document how to consume a diff programmatically Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 90/100

trailofbits/graphtage#185 · Opened Sep 9, 2026
Detect moved, split, and merged nodes when diffing Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/graphtage#184 · Opened Sep 9, 2026
Find a project that uses Hardhat 3.15.0 or later Open

Difficulty 3/5 1-2 days Newbie friendliness 65/100

trailofbits/necessist#1960 · Opened Sep 9, 2026
Import personal Codex skills and effective global instructions into guests Open

Difficulty 5/5 Over a week Newbie friendliness 48/100

trailofbits/coop#461 · Opened Sep 9, 2026
Guided setup for selecting and provisioning Claude and Codex customization Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

trailofbits/coop#460 · Opened Sep 9, 2026
Installing missing host packages assumes apt Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

trailofbits/coop#456 · 1 comment · Opened Sep 8, 2026
Remove local monitor_config.json files when available in TUF Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

trailofbits/rekor-watch#38 · Opened Sep 8, 2026
static-analysis: references/rulesets.md recommends p/express, which returns 404 Open

Difficulty 1/5 Under an hour Newbie friendliness 93/100

trailofbits/skills#299 · Opened Sep 7, 2026
static-analysis: files over 1 MB are dropped silently — the skill neither raises --max-target-bytes nor reports the skip Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

trailofbits/skills#298 · Opened Sep 7, 2026
static-analysis: run-scans.sh expands --include globs against the CWD, silently dropping an extension Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

trailofbits/skills#297 · Opened Sep 7, 2026
Publish macOS and Windows release archives for cargo-dylint and dylint-link Open

Difficulty 4/5 3-5 days Newbie friendliness 64/100

trailofbits/dylint#2068 · 1 comment · Opened Sep 4, 2026
Marketplace approval: ToRvaLDz/trailhead (project orchestration on GitHub Issues) Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/skills-curated#44 · Opened Aug 31, 2026
Pin the signer identity when verifying release attestations Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/coop#436 · Opened Aug 30, 2026
Windows packaging: CRLF makes every packaged Workflow unrunnable, and fp-check's Stop hook deadlocks the session (#205's fix never merged) Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

trailofbits/skills#289 · Opened Aug 28, 2026
Proposal: use ansible-static-lint in the pre-commit hook (526x faster, identical findings) Open

Difficulty 3/5 1-2 days Newbie friendliness 56/100

trailofbits/algo#15038 · Opened Aug 28, 2026
Document that an unimplemented opcode raises rather than being skipped (and 4 missing opcodes) Open

Difficulty 3/5 1-2 days Newbie friendliness 64/100

trailofbits/fickling#322 · 3 comments · Opened Aug 27, 2026
CI is still slow following #836 Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

trailofbits/cargo-unmaintained#838 · Opened Aug 25, 2026
cloud-linode : Create a stackscript Task failed: Module failed: No module named 'ansible_specdoc' Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

trailofbits/algo#15037 · Opened Aug 25, 2026
verify: spoc128 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/break-golf#5 · 1 comment · Opened Aug 24, 2026
verify: spoc128-ds Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/break-golf#4 · 1 comment · Opened Aug 24, 2026
verify: spoc128 Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

trailofbits/break-golf#3 · 1 comment · Opened Aug 24, 2026
verify: spoc128 Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/break-golf#2 · 1 comment · Opened Aug 24, 2026
Request approval: ArcticFox2029/chamnan — repository context, stdlib-only, no network Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

trailofbits/skills-curated#43 · Opened Aug 22, 2026
`merge-dependabot` evaluates five PRs in one working tree, then merges on the results Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

trailofbits/claude-code-config#59 · Opened Aug 21, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

trailofbits

Showing the newest 100

Get new issues in your inbox