Trail of Bits skills for Claude Code: what is inside, and when to use it

The problem this solves

You ask an agent to review a codebase for vulnerabilities. It reads a few files, finds three plausible issues, and stops. You have no idea whether it looked at the dangerous code, whether those three findings are real, or what it skipped.

Security review has a specific failure mode that general code review does not: a false positive costs an hour, and a false negative ships. An agent that volunteers findings without a pipeline behind them gives you neither coverage nor confidence.

This plugin is Trail of Bits' answer to that, and the structure is the point.

What makes it different: judges, not just finders

Most security skill packs are a list of things to look for. This one is a pipeline with adversarial stages, and the stages that matter most are the ones that throw findings away.

The c-review pipeline runs workers, then judges them:

• c-review-worker runs one assigned review cluster and writes its findings
• c-review-dedup-judge merges duplicates deterministically by location and bug class, then runs passes over same-function candidates, including the same bug filed under two different class names
• c-review-fp-judge runs only on merged primaries and decides a false positive verdict before anything reaches a report

Read that ordering again. Deduplication happens before false positive judging, and false positive judging happens before severity is assigned. A finding has to survive two independent stages that exist to kill it.

That is the opposite of how an unstructured agent behaves, and it is why the output is short.

The verification chain

Separately from c-review, three agents verify a single suspected vulnerability in sequence, each answering a different question:

Agent	Question it answers
data-flow-analyzer	Does untrusted input actually reach the sink, across trust boundaries?
exploitability-verifier	Is attacker control real, and do the bounds and race conditions permit it?
poc-builder	Can a proof of concept demonstrate it, and what preconditions does it need?

poc-builder also produces negative proofs of concept showing the conditions under which the exploit fails. That is a genuinely unusual artifact and it is what turns "this looks exploitable" into something a maintainer can act on.

adversarial-modeler sits upstream of all of it, building attacker scenarios for changes a differential review has already flagged as high risk.

The dimensional analysis set, which nobody else ships

Five agents implement dimensional analysis on arithmetic, a technique borrowed from physics and applied to financial and protocol code:

• arithmetic-scanner finds files containing dimensional arithmetic
• dimension-discoverer infers the vocabulary from naming conventions
• dimension-annotator adds annotations at anchor points
• dimension-propagator pushes them through call chains and reports mismatches
• dimension-validator detects the actual dimensional bugs

If you have ever shipped a bug where a value denominated in one unit was added to a value denominated in another, this is the tooling for that class. It is the most specialised thing in the plugin and the clearest signal that it came from people who audit protocols for a living.

How it compares

Both of these are real security skill sets on Flowy, and they solve different problems.

	trailofbits/skills	mukul975/anthropic-cybersecurity-skills
Components indexed	120	200+
Shape	skills plus agents plus commands plus MCP	skills only
Strength	pipelines with adversarial judging stages	breadth of individual techniques
Best when	you want findings you can trust	you want coverage across many topics

Pick this one when the cost of a false positive is your time and the cost of a false negative is a shipped vulnerability. Pick a broad skill set when you are learning the space or want a wider net.

One more thing

function-analyzer is worth knowing about on its own. It analyses a single function in depth for audit context, writing the prose analysis to disk and returning only a compact record. That split matters in practice: the long analysis is preserved for a human, and the calling agent's context stays small.

And yes, there is a let-fate-decide skill. Trail of Bits shipped a tarot reader inside a security plugin. It is real, it is indexed, and we are not going to pretend otherwise.

Getting it

Install from the listing page linked at the top of this guide. Flowy does not bundle any of these components. It indexes what the plugin ships so you can see the whole set before you install, and links you to the source.