Back to directory

Trail of Bits Skills

A Claude Code plugin marketplace from Trail of Bits providing security-research skills for smart contract auditing, code review, and other security analysis workflows.

Trail of Bits Skills

Trail of Bits Skills is a Claude Code plugin marketplace providing skills that enhance AI-assisted security analysis, testing and development workflows, and is also compatible with Codex through its Claude marketplace compatibility, as well as with a ChatGPT Workspace marketplace via the repository's own marketplace manifest.

Smart contract security plugins include a security toolkit with vulnerability scanners for six blockchains and development guideline assistants, and a tool that identifies state-changing entry points in smart contracts for auditing. Code auditing plugins cover auditing GitHub Actions workflows for AI agent security vulnerabilities, building context on a codebase before hunting for bugs, searching and extracting data from Burp Suite project files, comprehensive C/C++ security review verified against a parse of the source, security-focused differential review of code changes using git history, and annotating a codebase with dimensional-analysis comments to catch unit mismatches.

Plugins are installed through the Claude Code plugin marketplace commands, or added to Codex with its own plugin marketplace commands.

More in Agent skills

See all 581
  • Provenance gate

    github.com

    A deterministic authorization gateway that sits between an AI agent and its tools, tracing where each parameter of a side-effect call came from, and blocking the call or asking a human when the source does not check out.

  • A markdown framework of system rules that restates Isaac Asimov's Four Laws of Robotics as a set of prioritized loss calculations for large-language-model agents to follow, published as a discovery file for agents and crawlers to read.

  • Vitruvius

    github.com

    An engineering research agent that runs a discover, read, synthesize, verify and review loop over technical questions, reading sources directly rather than inferring from titles, and publishing its own scored verifier benchmark, weaknesses included.