Trail of Bits Skills Marketplace
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Also see: claude-code-config · codex-config · skills-curated · claude-code-devcontainer · dropkit · coop
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skills
Browse and Install Plugins
/plugin menu
Codex
Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.
Install the marketplace with:
codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills
Available Plugins
Smart Contract Security
| Plugin |
Description |
| building-secure-contracts |
Smart contract security toolkit with vulnerability scanners for 6 blockchains and 5 development guideline assistants |
| entry-point-analyzer |
Identify state-changing entry points in smart contracts for security auditing |
Code Auditing
| Plugin |
Description |
| agentic-actions-auditor |
Audit GitHub Actions workflows for AI agent security vulnerabilities |
| audit-context-building |
Understand a codebase before looking for bugs in it, one function at a time |
| burpsuite-project-parser |
Search and extract data from Burp Suite project files |
| c-review |
Comprehensive C/C++ security code review, with coverage verified against a parse of the source |
| differential-review |
Security-focused differential review of code changes with git history analysis |
| dimensional-analysis |
Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs |
| fp-check |
Systematic false positive verification for security bug analysis with mandatory gate reviews |
| insecure-defaults |
Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate file |
| rust-review |
Comprehensive Rust security review covering safe/unsafe boundary, memory safety, concurrency, panic-DoS, FFI, and async runtime with SARIF output |
| semgrep-rule-creator |
Create and refine Semgrep rules for custom vulnerability detection |
| semgrep-rule-variant-creator |
Port existing Semgrep rules to new target languages with test-driven validation |
| sharp-edges |
Identify error-prone APIs, dangerous configurations, and footgun designs |
| static-analysis |
Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing |
| supply-chain-risk-auditor |
Audit npm, PyPI, and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration, and install scripts |
| testing-handbook-skills |
Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage |
| trailmark |
Code graph analysis, bounded subagent context slicing, Mermaid diagrams, mutation testing triage, and protocol verification |
| variant-analysis |
Find similar vulnerabilities across codebases using pattern-based analysis |
| vulnerability-triage-brocards |
Triage vulnerability reports using 7 brocards to accept, dismiss, or request more info before deeper analysis |
Malware Analysis
| Plugin |
Description |
| yara-authoring |
YARA detection rule authoring with linting, atom analysis, and best practices |
Verification
| Plugin |
Description |
| constant-time-analysis |
Detect compiler-induced timing side-channels in cryptographic code |
| mutation-testing |
Configure mewt/muton mutation testing campaigns — scope targets, tune timeouts, optimize long runs |
| property-based-testing |
Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants |
| spec-to-code-compliance |
Check code against the documentation that specifies it, across contracts, C/C++, services, and firmware |
| writing-lean-proofs |
Write structured Lean 4 proofs and design Lean libraries following Mathlib conventions |
| zeroize-audit |
Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust |
Reverse Engineering
| Plugin |
Description |
| dwarf-expert |
Analyze DWARF debug info: parse and search DIEs, verify integrity, write DWARF parsing code |
Mobile Security
Development
| Plugin |
Description |
| code-improver |
Autonomous review-and-fix workflow over skills, plugins, or a branch, with a pluggable reviewer, findings ledger, escalation, and scope guard |
| devcontainer-setup |
Create pre-configured devcontainers with Claude Code and language-specific tooling |
| gh-cli |
Intercept GitHub URL fetches — WebFetch, MCP fetch tools, and curl/wget — and redirect to the authenticated gh CLI |
| git-cleanup |
Safely clean up git worktrees and local branches: a dynamic workflow gathers merge evidence and tries to refute its own delete recommendations, behind gated confirmation |
| goal-prompt |
Draft /goal commands for goal mode in Claude Code and Codex — verifiable completion conditions formatted to a copy-ready single line |
| github-triage |
Triage open GitHub issues and PRs: merge ready bot/approved PRs, review unreviewed ones via subagents, close resolved issues with cited comments, cross-link pending fixes, and score the rest with local-only priority and change-size estimates |
| let-fate-decide |
Draw Tarot cards using cryptographic randomness to add entropy to vague planning |
| modern-cpp |
Modern C++ best practices (C++20/23/26) with compiler hardening and safe idioms |
| modern-python |
Modern Python tooling and best practices with uv, ruff, and pytest |
| open-sourcing |
Prepare a repository for public release: secrets hygiene, licensing, CI readiness, and release automation |
| second-opinion |
Run code reviews using external LLM CLIs (OpenAI Codex, Google Antigravity) on changes, diffs, or commits. Bundles Codex's built-in MCP server. |
Team Management
| Plugin |
Description |
| culture-index |
Interpret Culture Index survey results for individuals and teams |
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention:
Found using Trail of Bits Skills
Contributing
We welcome contributions! See AGENTS.md for skill authoring guidelines, and
run make check before you push — it runs most of CI locally (see AGENTS.md for
what it does not cover).
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.
这是 Trail of Bits 的 Claude Code 插件市场，汇集了一批精选的 AI 智能体技能，用于安全研究、漏洞检测和审计工作流，涵盖从智能合约审计到恶意软件分析和逆向工程的各类场景。