trailofbits

skills: Security Workflows for Claude Code and Codex

Trail of Bits Skills is a Claude Code plugin marketplace for AI-assisted security analysis, testing, and development. Codex can load the marketplace through Claude plugin compatibility, giving teams a collection of focused audit and verification workflows.

ActivePythonCC-BY-SA-4.0AI AgentsSecurityCoding Agent
View on GitHub Compare
Stars
7.7k
Forks
667
Last commit
today
Contributors
62
Releases, 12 months
0

Our take

Activeregular commits

Health score

62/100

How it is scored
Activity
53
Community
78
Issues
60
Pull requests
57
  • Merges more pull requests than 80% of the projects we track

This is a broad, actively maintained collection of security-focused agent workflows, with adoption best suited to teams already using compatible coding agents and willing to review individual skills for their needs.

Good fit if

  • Your team uses Claude Code or Codex and wants ready-made security research, auditing, or verification workflows.
  • You want to select focused plugins from a sizable collection, including tools for smart contracts, native code, dependencies, and testing.
  • You value active maintenance: the repository has recent commits, contributions from many contributors without strong concentration in one person, and a short median time to close issues and merge pull requests.

Look elsewhere if

  • You need a standalone security scanner rather than skills designed to extend an AI coding-agent workflow.
  • You need a project with a published release history, as the supplied repository data records no releases in the last year.
  • Your distribution requirements are incompatible with the repository's CC BY-SA 4.0 license.
All health signals
Last commit2026-10-21 (today)
Commits, last 90 days100+
Releases, last 12 months0
Contributors62 (top contributor: 31% of commits)
Issues closed, last 90 days11+ (typically closed in 5 days)
Pull requests merged, last 90 days63 (typically merged in 1 day)
Project age9 months

Checked on 2026-10-21 with the GitHub API.

Overview

Trail of Bits Skills is a Claude Code plugin marketplace from Trail of Bits, built to extend Claude Code with skills for security analysis, testing, and development. It addresses the need for specialized, repeatable workflows when using AI coding agents for tasks such as auditing code, investigating vulnerabilities, and validating patches.

Codex can load the same marketplace through its Claude marketplace compatibility, and the README also documents imports into the ChatGPT Workspace Marketplace. The collection is aimed at security researchers, auditors, and development teams that want focused agent workflows rather than a single general-purpose security tool.

Key Features

  • Offers security review workflows for C/C++, Rust, smart contracts, GitHub Actions, dependencies, and other targets.
  • Includes static analysis and vulnerability discovery tools using CodeQL, Semgrep, SARIF, and pattern-based variant analysis.
  • Supports verification workflows for patch validation, regression hunting, mutation testing, property-based testing, and constant-time analysis.
  • Provides specialist tools for malware detection rule authoring, reverse engineering with DWARF, and Android Firebase configuration scanning.
  • Includes development and team utilities such as GitHub issue triage, repository preparation for release, and devcontainer setup.
  • Supports Claude Code marketplace installation, Codex marketplace loading, and documented ChatGPT Workspace imports.

Use Cases

  • A security auditor can use the audit-context and language-specific review skills to understand and inspect an unfamiliar codebase.
  • A product security team can triage reported vulnerabilities, search for related variants, and check whether a patch closes the issue without regressions.
  • A smart contract team can combine entry-point analysis, blockchain-specific scanners, and invariant-testing skills during an audit.
  • A developer investigating a security fix can use patching and post-patch validation workflows to produce reproducible evidence and regression checks.

What you need

Detected in the repository

  • Python (main language on GitHub)
  • Automated checks on GitHub Actions

License in plain words

CC-BY-SA-4.0

Read the LICENSE file before using it in a product.

Getting Started

Add the marketplace in Claude Code:

/plugin marketplace add trailofbits/skills

Then browse and install plugins with /plugin menu. See the README for Codex, ChatGPT Workspace, and local development instructions.

Alternatives

  • Anthropic-Cybersecurity-Skills: Provides structured workflows across 34 cybersecurity domains mapped to six frameworks, rather than Trail of Bits' security analysis, testing, and development skills.
ProjectLanguageLicenseStarsStatus
skillsPythonCC-BY-SA-4.07.7kActive
Anthropic-Cybersecurity-SkillsPythonApache-2.033.7kActive

Considerations

  • The repository is active and has a broad contributor base, but its lack of recorded releases means teams should track changes from the default branch and verify updates in their own workflows.
  • The repository contains many distinct plugins, so suitability and tool prerequisites may vary by plugin. The supplied repository facts do not specify shared runtime requirements.
  • The CC BY-SA 4.0 license includes attribution and share-alike obligations; review its terms before redistributing or adapting the material.
  • The README describes make check as covering most, but not all, of CI. It also directs skill authors to AGENTS.md for the remaining guidance.

Found this useful?

Share it with someone who would like skills.