marumo333
Community@marumo333
marumo333 provides security-audit skills for code graph analysis, fuzzing, static analysis, cryptographic protocol verification, and CI/CD pipeline hardening.
Agent Skills by marumo333
Showing 46 vetted skills indexed across 1 GitHub repositories.
marumo333agent-loop
Implements Atrox agent generation loops with arc_state transactions, agent_queue cron jobs, and Claude API calls.
marumo333ask-questions-if-underspecified
Generates targeted clarifying questions before implementing ambiguous requests.
marumo333git-cleanup
Categorizes and deletes local git branches and worktrees based on merge status.
marumo333audit-context-building
Performs line-by-line code analysis to build architectural context before security auditing.
marumo333claude-in-chrome-troubleshooting
Diagnose and fix Claude in Chrome MCP extension connectivity failures on macOS.
marumo333audit-augmentation
Projects SARIF and weAudit findings onto Trailmark code graphs as annotations and subgraphs.
marumo333trailmark
Builds and queries multi-language source code graphs for security analysis.
marumo333graph-evolution
Compares Trailmark code graphs between two snapshots to detect security-relevant structural changes.
marumo333trailmark-summary
Runs trailmark summary analysis to detect languages, entry points, and dependency graph shape in codebases.
marumo333vector-forge
Generates cryptographic test vectors by finding escaped mutants through mutation testing.
marumo333trailmark-structural
Runs trailmark structural analysis with blast radius, taint, privilege boundary, and complexity passes.
marumo333crypto-protocol-diagram
Extracts protocol message flow from code or specs and generates annotated Mermaid sequence diagrams.
marumo333semgrep-rule-creator
Creates and tests custom Semgrep rules for detecting security vulnerabilities and code patterns.
marumo333skill-improver
Iteratively reviews and fixes Claude Code skill quality issues using the skill-reviewer agent.
marumo333property-based-testing
Generate and review property-based tests across multiple languages and smart contracts.
marumo333differential-review
Performs security-focused differential review of code changes using git history and blast radius analysis.
marumo333insecure-defaults
Detects fail-open insecure defaults like hardcoded secrets and weak authentication in production code.
marumo333yara-rule-authoring
Write, review, and optimize YARA-X detection rules for malware identification.
marumo333variant-analysis
Find similar vulnerabilities across codebases using pattern-based analysis with CodeQL, Semgrep, and ripgrep.
marumo333supply-chain-risk-auditor
Audits project dependencies for supply chain takeover and exploitation risk factors.
marumo333fp-check
Verifies suspected security bugs and produces true positive or false positive verdicts with documented evidence.
marumo333agentic-actions-auditor
Audits GitHub Actions workflows for prompt injection vulnerabilities in AI agent integrations.
marumo333mutation-testing
Configures mewt and muton mutation testing campaigns with scoped targets and tuned timeouts.
marumo333dimensional-analysis
Annotates codebases with dimensional analysis comments to detect unit mismatches and arithmetic bugs.
Frequently Asked Questions About marumo333
FAQPage SchemaWhat tasks can I perform using marumo333's skills?▼
You can run Semgrep and CodeQL scans, parse SARIF results, build multi-language code graphs with Trailmark, fuzz C/C++/Rust/Python/Ruby targets, author YARA-X and Semgrep rules, verify crypto protocols with ProVerif, and audit GitHub Actions for prompt-injection risks.
Who are marumo333's skills designed for?▼
They target security auditors, smart contract reviewers, and application security engineers. Skills cover Solidity, Cairo, Circom, Rust, Go, and C/C++ analysis, plus DeFi dimensional analysis, supply-chain risk assessment, and false-positive verification of suspected bugs.
How do the fuzzing skills work in practice?▼
Skills guide harness writing, then run coverage-guided fuzzers such as AFL++, libFuzzer, cargo-fuzz, Atheris, or Ruzzy. Supporting skills handle AddressSanitizer integration, coverage analysis, fuzzing dictionaries, and patching obstacles like checksums that block fuzzer progress.
What prerequisites do these security skills require?▼
Most skills invoke Bash, Read, Grep, and Glob, so a shell environment with the relevant scanners installed is needed: Semgrep or Semgrep Pro, CodeQL CLI, Trailmark, and language toolchains like Cargo or Clang for compiling fuzz targets.
Do the skills support CI/CD and dependency security review?▼
Yes. The agentic-actions-auditor reviews GitHub Actions invoking Claude Code, Gemini CLI, or Codex for injection vectors, while supply-chain-risk-auditor flags dependencies at takeover risk, and sarif-parsing handles deduplication and CI/CD integration of scan output.