Trail of Bits skills
trailofbits/skills
A security firm's plugin marketplace for code auditing, smart contract review and testing.
Trail of Bits skills is a plugin marketplace from the security firm Trail of Bits, with skills for AI-assisted security analysis, testing and development. Plugins cover smart contract auditing, code review, static analysis, malware rule writing, verification and everyday development tasks. It is licensed CC BY-SA 4.0, not a software license, and loads in Claude Code and Codex.
Facts checked on against the sources listed at the end of this page.
- GitHub stars
- 7,347
- Skills in the pack
- 83
- Agents supported
- 3Codex loads the repo through its Claude marketplace compatibility
- Instruction size
- 141k wordsacross all SKILL.md files
How to install Trail of Bits skills
| Agent | Command | Copy |
|---|---|---|
| Claude Code | Run /plugin menu to browse and install individual plugins. | |
| Codex | |
Commands as given in the README on 3 October 2026.
What is inside Trail of Bits skills
| Skill | What it makes the agent do |
|---|---|
| building-secure-contracts | Vulnerability scanners for 6 blockchains and 5 development guideline assistants. |
| agentic-actions-auditor | Audits GitHub Actions workflows for AI agent security problems. |
| audit-context-building | Builds an understanding of a codebase one function at a time before bug hunting. |
| differential-review | Security-focused review of code changes using git history. |
| static-analysis | A toolkit around CodeQL, Semgrep and SARIF parsing. |
| supply-chain-risk-auditor | Checks npm, PyPI and Go dependencies for advisories, abandoned upstreams and install scripts. |
| insecure-defaults | Parallel audit for fail-open insecure defaults. |
| semgrep-rule-creator | Creates and refines Semgrep rules for custom checks. |
| property-based-testing | Writes and triages property-based tests with Hypothesis, fast-check and proptest. |
| modern-python | Python tooling and best practices with uv, ruff and pytest. |
Ten plugins are shown, and 83 is the number of SKILL.md files under plugins/. The README groups plugins into smart contract security, code auditing, malware analysis, verification, reverse engineering, mobile security, development and team management.
What Trail of Bits skills runs on your machine
| Hooks | Yes, in three plugins. fp-check, gh-cli and modern-python each ship a hooks file. The README says gh-cli intercepts GitHub URL fetches from WebFetch, MCP fetch tools and curl or wget, and redirects them to the authenticated gh CLI. |
|---|---|
| Bundled scripts | Yes. Some plugins ship shell and Python scripts, for example a Burp Suite project search script. The repo also has CI scripts that check plugin metadata. |
| Network calls | Varies by plugin. Skills such as github-triage and gh-cli use the GitHub CLI, and the supply chain auditor looks up advisories for your dependencies. Check each plugin before enabling it. |
| API keys needed | None named in the README. |
These are facts read from the repo, not a security rating. Read the files before you install any skill.
How much context Trail of Bits skills uses
| All 83 skills | 141,123 words across every SKILL.md file |
|---|---|
| Largest skill | rust-review, 5,867 words |
| Loaded at start | Only each skill's name and description. The full text loads when a task needs that skill. |
Word counts are measured from the repo every day. Reference files a skill loads on demand are not counted.
How Trail of Bits skills works
Install only the plugins you need, since each one is a separate plugin in the marketplace. The README says contributions follow the guidelines in AGENTS.md, and a trophy case lists bugs found with the skills, including a timing side channel in ML-DSA signing.
The license covers the skills as creative work, not as software, and it requires attribution and share-alike. Some plugins relate to security research and reverse engineering, such as YARA rule authoring and an Android APK scanner for Firebase misconfigurations. One plugin, let-fate-decide, draws tarot cards for planning.
A good fit for
- Security engineers who want an agent to follow audit methods from a security firm
- Smart contract auditors working across several blockchains
- Teams that review code changes for security problems and want git-history-aware checks
- Developers who want to choose single plugins, since the marketplace installs them separately
Skip it if
- Teams that need a permissive software license, since the repo uses CC BY-SA 4.0
- Anyone who wants a single small skill, because the marketplace has dozens of plugins
- Agents other than Claude Code and Codex, which are the two the README names
Is Trail of Bits skills still maintained?
| Last commit | , 4 days ago |
|---|---|
| Stars gained in 7 days | Shown after 7 days of tracking |
| Stars gained in 30 days | Shown after 30 days of tracking |
| Open issues and pull requests | 55 |
| Forks | 628 |
Tools Trail of Bits skills works with
Questions about Trail of Bits skills
What license does Trail of Bits skills use?
Creative Commons Attribution-ShareAlike 4.0. It requires attribution and share-alike, so read it before reusing the content.
Do I install everything?
No. Each plugin installs on its own through /plugin menu in Claude Code, or codex plugin add in Codex.
Does it run code on my machine?
Some plugins do. Three ship hooks, and several include shell or Python scripts. Review the plugin you enable.
Does it work in Codex?
Yes. The README says Codex supports Claude plugin marketplaces directly, so the repo needs no Codex-specific files.
Who makes it?
Trail of Bits, a security firm. The README lists related repos for Claude Code and Codex configuration.