skills
Security skills from Trail of Bits for Claude Code that audit GitHub Actions AI integrations, review smart contracts on Algorand and Cairo, and prepare codebases for security audits.
95 skills7.9k
@trailofbits- 10,621Stars earned
- 3Plugins
- 126Skills
- 31Agents
- 16Commands
- 1MCP server
- 2Hooks
Plugins
3@trailofbitsclaude-code-config
Opinionated Claude Code defaults and workflows from Trail of Bits, covering sandboxing, permissions, hooks, MCP servers, and usage patterns for security audits, development, and research.
2.1k
@trailofbitsskills-curated
Security skills for Claude Code from Trail of Bits, covering web fuzzing with ffuf, headless Ghidra binary reverse engineering, and threat modeling and vulnerability scanning, plus writing and research helpers.
31 skills535
@trailofbitsSkills
126address-sanitizer
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or…
@trailofbitsadjudicate-regression
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
@trailofbitsaflpp
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation…
@trailofbitsagentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
@trailofbitsalgorand-vulnerability…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
@trailofbitsatheris
Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses,…
@trailofbitsaudit-augmentation
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and…
@trailofbitsaudit-context-building
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
@trailofbitsaudit-prep-assistant
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
@trailofbitsburpsuite-project-pars…
Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with…
@trailofbitsc-review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific…
@trailofbitscairo-vulnerability-sc…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
@trailofbitsAgents
310-preflight
AgentPerforms preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces…
@trailofbits1-mcp-resolver
AgentResolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so…
@trailofbits2-source-analyzer
AgentIdentifies sensitive objects, detects wipe calls, validates correctness, and performs data-flow/heap analysis for zeroize-audit.…
@trailofbits2b-rust-source-analyze…
AgentPerforms source-level zeroization analysis for Rust crates in zeroize-audit. Generates rustdoc JSON for trait-aware analysis and…
@trailofbits3-tu-compiler-analyzer
AgentPerforms per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per…
@trailofbits3b-rust-compiler-analy…
AgentPerforms crate-level MIR and LLVM IR analysis for Rust in zeroize-audit. A single instance runs per crate (unlike…
@trailofbits4-report-assembler
AgentCollects all findings from source and compiler analysis, applies supersessions and confidence gates, normalizes IDs, and produces…
@trailofbits5-poc-generator
AgentCrafts bespoke proof-of-concept programs demonstrating that zeroize-audit findings are exploitable. Reads source code and finding…
@trailofbits5b-poc-validator
AgentCompiles and runs all PoCs for zeroize-audit findings. Produces poc_validation_results.json consumed by the verification agent…
@trailofbits5c-poc-verifier
AgentVerifies that each zeroize-audit PoC actually proves the vulnerability it claims to demonstrate. Reads PoC source code, finding…
@trailofbits6-test-generator
AgentGenerates runtime validation test harnesses (C tests, MSAN, Valgrind targets) for confirmed zeroize-audit findings. Produces a…
@trailofbitsadversarial-modeler
AgentModels attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies…
@trailofbitsCommands
16audit
CommandAudit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
@trailofbitsburp-search
CommandSearches Burp Suite project files for security analysis
@trailofbitsct-check
CommandDetects timing side-channels in cryptographic code
@trailofbitsdiff-review
CommandPerforms security-focused differential review of code changes
@trailofbitsentry-points
CommandIdentifies state-changing entry points in smart contracts
@trailofbitsgit-cleanup
CommandSafely analyzes and cleans up local git branches and worktrees, categorizing them as merged, squash-merged, superseded, or active…
@trailofbitsscan-apk
CommandScans Android APKs for Firebase security misconfigurations
@trailofbitssemgrep-rule
CommandCreates Semgrep rules with test-first methodology
@trailofbitsconfig
CommandYou are installing or updating Trail of Bits' Claude Code configuration into the user's `~/.claude/` directory.
@trailofbitsfix-issue
Command@description End-to-end: plan, implement, test, review, fix, push, and PR for a GitHub issue. @arguments $ISSUE_NUMBER: GitHub…
@trailofbitsmerge-dependabot
Command@description Evaluate and merge dependabot PRs with parallel builds, dependency-aware batching, and transitive dep analysis.…
@trailofbitsreview-pr
Command@description Review an existing PR with parallel agents, fix findings, and push. @arguments $PR_NUMBER: GitHub PR number to…
@trailofbitsIs this you? Claim your profilePut a plugin at the top of Plugins, from $9