Trail of Bits Skills: a security firm's audit methods in your agent
A good security audit rests on method that usually lives in specialists' heads. Trail of Bits publishes its plugins for Claude Code and Codex: smart contract vulnerability scanners, C/C++ and Rust review, CodeQL and Semgrep static analysis, dependency risk checks and tools for ruling out false positives.
building-secure-contracts bundles vulnerability scanners for six blockchains, among them Solana, Cosmos, Substrate and TON, plus five guideline assistants.
c-review and rust-review cover memory safety, integer overflows, races, FFI and the unsafe boundary; rust-review writes SARIF output.
supply-chain-risk-auditor checks npm, PyPI and Go dependencies for version-matched advisories, abandoned upstreams and install scripts.
fp-check works through a suspected bug step by step and returns TRUE POSITIVE or FALSE POSITIVE with the evidence written down.
constant-time-analysis hunts timing side channels in crypto code; the README credits it with one found in RustCrypto's ML-DSA signing.
When to use it
An external audit is coming and the repository needs static analysis, better test coverage and dead code removed first.
A pull request touches authorization logic and you want a review that weighs git history and how many callers each change reaches.
You wrote a Semgrep rule for one bug and want variant-analysis to find the same pattern elsewhere in the codebase.
Ask your agent
Run differential-review on this branch and flag changes that touch permission checks
Scan this Anchor program for missing signer and ownership checks
Use fp-check to tell me whether the buffer overflow finding in parser.c is real
Questions
How do I install Trail of Bits Skills?
In Claude Code add the marketplace with /plugin marketplace add trailofbits/skills, then pick plugins from /plugin menu. With the skills CLI the whole set installs via npx skills add trailofbits/skills.
Do the Trail of Bits plugins work in Codex?
Yes. Codex reads Claude plugin marketplaces directly: run codex plugin marketplace add trailofbits/skills, then codex plugin add with the plugin name and @trailofbits.
Can I use these skills in commercial work?
CC BY-SA 4.0 permits commercial use as long as you give attribution. Any modified version you distribute has to carry the same licence.
