Trail of Bits Skills: Security Auditing for Claude Code
Trail of Bits' skills marketplace adds 46 security plugins to Claude Code: code auditing, static analysis, smart contracts, fuzzing and verification. Setup.
By Claudekit Team Published 1 min read
- Category
- Security
- Source
- github.com
- Repository
- github.com
- GitHub stars
- 7,762
- License
- CC-BY-SA-4.0
Install
/plugin marketplace add trailofbits/skillsTrail of Bits Skills is a Claude Code plugin marketplace from Trail of Bits, one of the best-known security research firms. It packages the firm’s auditing know-how into skills and plugins for AI-assisted security analysis, testing and development. When we checked today the marketplace listed 46 plugins.
What it covers
- Code auditing:
audit-context-building,differential-review,c-review,rust-review,insecure-defaults,sharp-edges,variant-analysis,supply-chain-risk-auditor,fp-checkfor false-positive verification. - Static analysis: a CodeQL, Semgrep and SARIF toolkit, plus Semgrep rule creation and porting.
- Smart contracts:
building-secure-contractswith scanners for six blockchains, andentry-point-analyzer. - Verification and testing: property-based testing, mutation testing, constant-time analysis, zeroization audits, Lean proofs, regression hunting.
- Other: YARA rule authoring, DWARF analysis, Burp Suite project parsing, an auditor for AI agent risks in GitHub Actions.
Install
/plugin marketplace add trailofbits/skills
/plugin menuBrowse and install the plugins you need. See our plugins guide for scopes.
Example prompts
Do a security-focused differential review of this branch against main
Run Semgrep and CodeQL on this repo and triage the SARIF results
Audit our npm dependencies for abandoned packages and risky install scripts
Check this crypto code for compiler-induced timing side channelsTips and limits
- Install narrowly: security plugins are detailed and add context.
- Some plugins expect external tools (Semgrep, CodeQL, fuzzers) to be installed.
- License is CC-BY-SA-4.0, which has share-alike terms if you adapt and redistribute the content.
- Complements Anthropic’s claude-code-action for CI reviews.
Related: Sentry skills (security review, skill scanner), hooks guide.
Frequently asked questions
Do I install every Trail of Bits plugin?
No. Add the marketplace, then pick plugins from /plugin menu that match your languages and threat model, such as static-analysis or differential-review.
Does it replace a professional audit?
No. The skills encode expert workflows and tooling, but findings still need human validation, which is why plugins like fp-check exist.
Does it work with Codex too?
Yes. Codex can add the same marketplace with codex plugin marketplace add trailofbits/skills.