Trail of Bits Skills 🧩 Skill Free

What it does

This is a plugin marketplace from security firm Trail of Bits. Its skills are built for security analysis, auditing and testing work with a coding agent. The skills turn the firm's audit practice into repeatable steps. For example, they tell the agent to build context on a codebase before hunting for bugs, to check suspected findings for false positives, and to search for variants of a known bug.

What is inside

At the time of writing (September 2026) the marketplace lists dozens of plugins, grouped as follows:

• Smart contracts: building-secure-contracts, with vulnerability scanners for six blockchains, and entry-point-analyzer.
• Code auditing: static-analysis (CodeQL, Semgrep, SARIF), semgrep-rule-creator, variant-analysis, differential-review, c-review, rust-review, insecure-defaults, sharp-edges, supply-chain-risk-auditor, fp-check and more.
• Verification: constant-time-analysis, mutation-testing, property-based-testing, spec-to-code-compliance, zeroize-audit and Lean proof writing.
• Other areas: YARA rule authoring, DWARF analysis, Firebase APK scanning, Burp Suite project parsing.
• General development: modern-python, modern-cpp, devcontainer setup, git cleanup, GitHub triage and second-opinion reviews.

Works with

It is a Claude Code plugin marketplace. The README says Codex can load it through its support for Claude marketplaces, and it can also be imported into a ChatGPT workspace marketplace.

How to install

/plugin marketplace add trailofbits/skills
/plugin menu

For Codex:

codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits

Maintenance and safety

The repository is licensed CC BY-SA 4.0 and is actively updated. Many plugins drive real tools such as CodeQL, Semgrep, fuzzers and git operations, so those tools must be installed. The skills will run commands against the code you point them at. Install only the plugins you need rather than the whole marketplace.

Who should use it

Security engineers, auditors and smart-contract developers who want an agent that works like a reviewer. Everyday app builders will get more from a few general plugins than from the specialised audit tooling.