trailofbits/skills

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

What it solves

This project provides a marketplace of specialized "skills" (plugins) for AI agents—specifically Claude Code and Codex—to enhance their ability to perform complex security analysis, software testing, and development workflows. It bridges the gap between general-purpose LLMs and the specialized, high-precision requirements of security auditing and reverse engineering.

How it works

The repository acts as a plugin marketplace that can be loaded into AI agents like Claude Code, Codex, and ChatGPT Workspaces. These plugins provide the agent with specific methodologies, tool integrations (such as Semgrep, CodeQL, and SARIF), and structured workflows for tasks like smart contract auditing, malware analysis, and formal verification.

Who it’s for

Security researchers, smart contract auditors, software engineers, and AI-assisted developers who want to augment their AI agents with professional-grade security and verification toolsets.

Highlights

  • Security Auditing: Specialized plugins for C/C++, Rust, and smart contracts, including vulnerability scanners and entry-point analyzers.
  • Verification & Testing: Tools for mutation testing, property-based testing, and detecting timing side-channels in cryptographic code.
  • Verification: Tools for writing Lean 4 proofs and checking code compliance against specifications.
  • Development Workflow: Plugins for autonomous review-and-fix workflows, GitHub triage, and modern C++/Python best practices.
  • Reverse Engineering: Specialized capabilities for analyzing DWARF debug information.
  • Multimodal Support: Compatibility with Claude Code, Codex, and ChatGPT Workspace marketplaces.

Related

  • Project
    athola/claude-night-market

    A plugin marketplace for Claude Code that adds professional engineering workflows, TDD enforcement, and autonomous agent capabilities to the AI terminal.

  • Project
    borghei/Claude-Skills

    Claude Skills is an open‑source library of 385 ready‑to‑use “skills” – prompt‑plus‑Python bundles – that can be loaded into Claude, ChatGPT, Gemini, Copilot, Cursor and other LLM assistants. It ships 77 expert personas, 900 pure‑Python tools, and compliance workflows for 18 regulated frameworks, letting non‑engineers run real business, product‑management and compliance tasks via slash‑commands or plugin installation.

  • Project
    shinpr/claude-code-workflows

    A set of structured development workflows and plugins for Claude Code that ensure AI-generated code stays within scope and is verified against agreed-upon design documents.

  • Project
    umputun/cc-thingz

    A marketplace of plugins for Claude Code that adds professional engineering workflows, including structured planning, autonomous plan execution, and interactive code review tools.

  • Project
    ericlitman/open-pstack

    A plugin for Claude Code and Codex that implements a rigorous engineering framework for coding agents, emphasizing verification, multi-model review, and structured workflows.