trailofbits/skills

What it solves

This project provides a curated marketplace of "skills" (plugins) for AI-assisted security analysis, testing, and development. It bridges the gap between general-purpose LLMs and specialized security tooling by providing the AI agent with specific workflows and capabilities for auditing code, analyzing malware, and verifying software correctness.

How it works

The marketplace is designed for use with Claude Code and Codex, allowing these AI agents to load and execute specialized plugins. These plugins extend the agent's ability to perform complex tasks such as static analysis, smart contract auditing, and vulnerability triage.

Who it’s for

Security researchers, software auditors, and developers who use AI agents to enhance their security workflows, particularly those focusing on C/C++, Rust, smart contracts, and mobile security.

Highlights

• Security Auditing: Includes tools for C/C++ and Rust security reviews, differential review, and variant analysis.
• Smart Contract Security: Specialized toolkits for vulnerability scanning across six blockchains.
• Verification & Analysis: Tools for constant-time analysis to detect timing side-channels and property-based testing support.
• Development Workflows: Plugins for GitHub triage, code improvement, and modern C++/Python best practices.
• Malware & Reverse Engineering: Support for YARA rule authoring and DWARF debug info analysis.