# Tools

> Every listed resource, editors’ picks first. The filters below can be combined.

- Search: append `?q=<keywords>` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README.
- Filter by type: append `?type=<cli|skill|plugin|mcp>` to the URL.
- Filter by profession: append `?profession=<profession id>` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions
- Filter by tag: append `?tag=<tag>` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags

Resources for Full-stack / Indie or DevOps / SRE or ML / AI or Founders, Tagged `trailofbits`: 6 items.

> - Full-stack / Indie: General software work: coding-agent workflows, code review, debugging and Git collaboration.
> - DevOps / SRE: Deployment, monitoring, cloud resources and reliability.
> - ML / AI: Model training, evaluation and LLM application development.
> - Founders: Business plans, fundraising decks, business analysis and team management.

- [Trail of Bits Skills](https://hebbmind.com/skill/trailofbits-skills.md): [Skill] Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.
- [Supply Chain Risk Auditor](https://hebbmind.com/skill/supply-chain-risk-auditor.md): [Skill] Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.
- [Culture Index](https://hebbmind.com/plugin/culture-index.md): [Plugin] Trail of Bits plugin for Culture Index assessments: profiles individual traits, checks team balance (gas, brake, glue), compares people with job profiles to flag burnout and attrition risk, and helps draft hiring profiles. Needs your own reports (JSON or PDF); PDFs need uv.
- [Differential Review](https://hebbmind.com/skill/differential-review.md): [Skill] From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.
- [Agentic Actions Auditor](https://hebbmind.com/skill/agentic-actions-auditor.md): [Skill] Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.
- [Static Analysis](https://hebbmind.com/skill/static-analysis.md): [Skill] Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.