trailofbits/skills

Plugin marketplace

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

GitHub stars: 4.3K
plugins: 28
last updated: Feb 24, 2026

View on GitHub

Add marketplace

/plugin marketplace add trailofbits/skills

Run it inside Claude Code, then install plugins from it with /plugin.

Plugins

1ask-questions-if-underspecifiedClarify ambiguous requirements by asking questions before implementing. Only when invoked explicitly.1.0.1version

2audit-context-buildingBuild deep architectural context through ultra-granular code analysis before vulnerability hunting1.1.0version

3building-secure-contractsComprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.1.0.1version

4burpsuite-project-parserSearch and extract data from Burp Suite project files (.burp) for security analysis1.0.0version

5claude-in-chrome-troubleshootingDiagnose and fix Claude in Chrome MCP extension connectivity issues1.0.0version

6constant-time-analysisDetect compiler-induced timing side-channels in cryptographic code0.1.0version

7culture-indexInterprets Culture Index survey results for individuals and teams1.1.0version

8debug-buttercupDebug Buttercup Kubernetes deployments1.0.0version

9devcontainer-setupCreate pre-configured devcontainers with Claude Code and language-specific tooling0.1.0version

10differential-reviewSecurity-focused differential review of code changes with git history analysis and blast radius estimation1.0.0version

11dwarf-expertInteract with and understand the DWARF debugging format1.0.0version

12entry-point-analyzerAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.1.0.0version

13firebase-apk-scannerScan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.2.1.0version

14gh-cliIntercepts GitHub URL fetches and curl/wget commands, redirecting to the authenticated gh CLI. Includes gh CLI usage guidance.1.3.0version

15git-cleanupSafely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.1.0.0version

16insecure-defaultsDetects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production1.0.0version

17modern-pythonModern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.1.5.0version

18property-based-testingProperty-based testing guidance for multiple languages and smart contracts1.1.0version

19second-opinionRuns code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles codex-mcp-server for direct MCP tool access to Codex.1.5.1version

20semgrep-rule-creatorCreate custom Semgrep rules for detecting bug patterns and security vulnerabilities1.1.0version

21semgrep-rule-variant-creatorCreates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation1.0.0version

22sharp-edgesIdentify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes1.0.0version

23spec-to-code-complianceSpecification-to-code compliance checker for blockchain audits with evidence-based alignment analysis1.1.0version

24static-analysisStatic analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection1.1.0version

25testing-handbook-skillsSkills from the Trail of Bits Application Security Testing Handbook (appsec.guide)1.0.1version

26variant-analysisFind similar vulnerabilities and bugs across codebases using pattern-based analysis1.0.0version

27workflow-skill-designTeaches design patterns for workflow-based Claude Code skills and provides a review agent for auditing existing skills1.0.1version

28yara-authoringYARA-X detection rule authoring with linting and quality analysis2.0.0version

Details

Repository: github.com/trailofbits/skills
Categories: community
Listed since: Feb 24, 2026