trailofbits/skills
4,329 stars28 plugins
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
Add marketplace
/plugin marketplace add trailofbits/skills
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →#PluginVersion
1
ask-questions-if-underspecifiedClarify ambiguous requirements by asking questions before implementing. Only when invoked explicitly.
1.0.12
audit-context-buildingBuild deep architectural context through ultra-granular code analysis before vulnerability hunting
1.1.03
building-secure-contractsComprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.
1.0.14
burpsuite-project-parserSearch and extract data from Burp Suite project files (.burp) for security analysis
1.0.05
claude-in-chrome-troubleshootingDiagnose and fix Claude in Chrome MCP extension connectivity issues
1.0.09
devcontainer-setupCreate pre-configured devcontainers with Claude Code and language-specific tooling
0.1.010
differential-reviewSecurity-focused differential review of code changes with git history analysis and blast radius estimation
1.0.012
entry-point-analyzerAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.
1.0.013
firebase-apk-scannerScan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.
2.1.014
gh-cliIntercepts GitHub URL fetches and curl/wget commands, redirecting to the authenticated gh CLI. Includes gh CLI usage guidance.
1.3.015
git-cleanupSafely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.
1.0.016
insecure-defaultsDetects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production
1.0.017
modern-pythonModern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.
1.5.018
property-based-testingProperty-based testing guidance for multiple languages and smart contracts
1.1.019
second-opinionRuns code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles codex-mcp-server for direct MCP tool access to Codex.
1.5.120
semgrep-rule-creatorCreate custom Semgrep rules for detecting bug patterns and security vulnerabilities
1.1.021
semgrep-rule-variant-creatorCreates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation
1.0.022
sharp-edgesIdentify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes
1.0.023
spec-to-code-complianceSpecification-to-code compliance checker for blockchain audits with evidence-based alignment analysis
1.1.024
static-analysisStatic analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
1.1.025
testing-handbook-skillsSkills from the Trail of Bits Application Security Testing Handbook (appsec.guide)
1.0.126
variant-analysisFind similar vulnerabilities and bugs across codebases using pattern-based analysis
1.0.027
workflow-skill-designTeaches design patterns for workflow-based Claude Code skills and provides a review agent for auditing existing skills
1.0.1Featured
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →