skills

Trail of Bits Skills Marketplace

Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.

Also see: claude-code-config · codex-config · skills-curated · trailmark · calcifier · coop

Installation

Claude Code Marketplace

/plugin marketplace add trailofbits/skills

Browse and Install Plugins

/plugin menu

Codex

Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.

Install the marketplace with:

codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits

ChatGPT Workspace Marketplace

Use this repository's .claude-plugin/marketplace.json for workspace imports. Skills that include agents/openai.yaml also need interface.display_name and interface.short_description in that YAML file; plugin metadata does not supply them. After a metadata fix is published, sync the repository again in your workspace marketplace to retry failed imports.

Local Development

To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:

cd /path/to/parent  # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills

Available Plugins

Smart Contract Security

Plugin	Description
building-secure-contracts	Smart contract security toolkit with vulnerability scanners for 6 blockchains and 5 development guideline assistants
entry-point-analyzer	Identify state-changing entry points in smart contracts for security auditing

Code Auditing

Plugin	Description
agentic-actions-auditor	Audit GitHub Actions workflows for AI agent security vulnerabilities
audit-context-building	Understand a codebase before looking for bugs in it, one function at a time
burpsuite-project-parser	Search and extract data from Burp Suite project files
c-review	Comprehensive C/C++ security code review, with coverage verified against a parse of the source
cvss-scoring	Produce CVSS v4.0 vectors with metric justifications and a calculator link
differential-review	Security-focused differential review of code changes with git history analysis
dimensional-analysis	Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs
fp-check	Systematic false positive verification for security bug analysis with mandatory gate reviews
insecure-defaults	Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate file
rust-review	Comprehensive Rust security review covering safe/unsafe boundary, memory safety, concurrency, panic-DoS, FFI, and async runtime with SARIF output
semgrep-rule-creator	Create and refine Semgrep rules for custom vulnerability detection
semgrep-rule-variant-creator	Port existing Semgrep rules to new target languages with test-driven validation
sharp-edges	Identify error-prone APIs, dangerous configurations, and footgun designs
static-analysis	Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing
supply-chain-risk-auditor	Audit npm, PyPI, and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration, and install scripts
testing-handbook-skills	Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage
trailmark	Code graph analysis, bounded subagent context slicing, Mermaid diagrams, mutation testing triage, and protocol verification
variant-analysis	Find similar vulnerabilities across codebases using pattern-based analysis
vulnerability-triage-brocards	Triage vulnerability reports using 7 brocards to accept, dismiss, or request more info before deeper analysis

Malware Analysis

Plugin	Description
yara-authoring	YARA detection rule authoring with linting, atom analysis, and best practices

Verification

Plugin	Description
constant-time-analysis	Detect compiler-induced timing side-channels in cryptographic code
mutation-testing	Configure mutation testing, analyze surviving mutants, and investigate bugs in weakly tested code
patching-bugs	Reproduce and validate one known bug, commit a scoped patch, and produce reviewable proof and regression reports
post-patch-validation	Help patch authors find missed variants and regressions, with reproducible failures and explicit validation gaps
property-based-testing	Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants
regression-hunt	Find and validate regressions across PRs and commits using discovery, reproduction, and replayed evidence
spec-to-code-compliance	Check code against the documentation that specifies it, across contracts, C/C++, services, and firmware
writing-lean-proofs	Write structured Lean 4 proofs and design Lean libraries following Mathlib conventions
zeroize-audit	Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust

Reverse Engineering

Plugin	Description
dwarf-expert	Analyze DWARF debug info: parse and search DIEs, verify integrity, write DWARF parsing code

Mobile Security

Plugin	Description
firebase-apk-scanner	Scan Android APKs for Firebase security misconfigurations

Development

Plugin	Description
code-improver	Autonomous review-and-fix workflow over skills, plugins, or a branch, with a pluggable reviewer, findings ledger, escalation, and scope guard
devcontainer-setup	Create pre-configured devcontainers with Claude Code and language-specific tooling
gh-cli	Intercept GitHub URL fetches — WebFetch, MCP fetch tools, and curl/wget — and redirect to the authenticated gh CLI
git-cleanup	Safely clean up git worktrees and local branches: a dynamic workflow gathers merge evidence and tries to refute its own delete recommendations, behind gated confirmation
goal-prompt	Draft /goal commands for goal mode in Claude Code and Codex — verifiable completion conditions formatted to a copy-ready single line
github-triage	Triage open GitHub issues and PRs: merge ready bot/approved PRs, review unreviewed ones via subagents, close resolved issues with cited comments, cross-link pending fixes, and score the rest with local-only priority and change-size estimates
let-fate-decide	Draw Tarot cards using cryptographic randomness to add entropy to vague planning
modern-cpp	Modern C++ best practices (C++20/23/26) with compiler hardening and safe idioms
modern-python	Modern Python tooling and best practices with uv, ruff, and pytest
open-sourcing	Prepare a repository for public release: secrets hygiene, licensing, CI readiness, and release automation
review-walkthrough	Generate an interactive walkthrough of branch changes with ordered diffs, explanations, and anchored review findings
second-opinion	Get independent reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits

Team Management

Plugin	Description
culture-index	Interpret Culture Index survey results for individuals and teams

Tooling

Plugin	Description
chrome-mcp-troubleshooting	Diagnose and fix Claude in Chrome MCP extension connectivity issues

Trophy Case

Bugs discovered using Trail of Bits Skills. Found something? Let us know!

When reporting bugs you've found, feel free to mention:

Found using Trail of Bits Skills

Skill	Bug
constant-time-analysis	Timing side-channel in ML-DSA signing

Contributing

We welcome contributions! See AGENTS.md for skill authoring guidelines, and run make check before you push — it runs most of CI locally (see AGENTS.md for what it does not cover).

Codex provides advisory fast reviews for eligible PRs from this repository. Maintainers with write access can request another fast review by commenting @codex review, or a deeper review by applying the deep-review label. Fork PRs are excluded.

License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.