Trail of Bits Skills

A Claude Code plugin marketplace from security firm Trail of Bits: 44 plugins of security-focused agent skills covering code auditing (C/C++ and Rust review, differential review, variant analysis, Semgrep/CodeQL/static-analysis toolkits, supply-chain auditing), smart-contract security (vulnerability scanners for 6 blockchains), verification (constant-time analysis, mutation testing, property-based testing, Lean proofs), malware analysis (YARA authoring), reverse engineering (DWARF), mobile security, and dev workflows.

Each plugin ships real SKILL.md files with YAML frontmatter — many with dedicated subagents, scripts, and hooks — and the repo keeps a public trophy case of bugs found with the skills (e.g. a timing side-channel in ML-DSA signing reported to RustCrypto). A separate, staff-vetted trailofbits/skills-curated marketplace exists for third-party plugins. Note the CC-BY-SA-4.0 license (share-alike) rather than a permissive software license.

1. Open Claude Code and add the marketplace: /plugin marketplace add trailofbits/skills.
2. Browse and install plugins with /plugin menu.
3. Invoke a skill by its slash command, e.g. /rust-review:rust-review runs the Rust security review orchestrator.
4. Codex: the marketplace is loaded via Claude marketplace compatibility — codex plugin marketplace add trailofbits/skills, then codex plugin add <plugin-name>@trailofbits.
5. Install any third-party tooling the skill you use needs (e.g. Semgrep, CodeQL, Burp Suite) — the plugin READMEs document their prerequisites.
6. Review findings carefully: agentic audits produce leads with false positives; the repo's own fp-check skill exists for systematic false-positive verification.