trailofbitsOfficial·91 Agent Skills Included

skills

Security auditing skills for code review, fuzzing, and vulnerability triage

Audits codebases for security vulnerabilities across C/C++, Rust, Solidity, and web services using multi-agent review pipelines. Covers static analysis with Semgrep and CodeQL, mutation testing, cryptographic protocol verification, dependency risk audits, and false-positive triage. Eliminates manual checklist work by turning expert security review methodology into repeatable, evidence-backed agent workflows.

6,932|598

↗

npx skills add trailofbits/skills --all -g -y

All Skills in This Repository (91)

Pure Emerald Level Indicators

📦 In Repo

trailofbits

dwarf-expert

Explain DWARF debug information and DIE trees from compiled binaries.

ask-questions-if-underspecified

Identify underspecified requests and generate clarifying questions before implementation.

interpreting-culture-index

Interpret Culture Index profiles from PDF or JSON inputs into structured CI insights.

audit-context-building

Build a line-by-line mental model of codebases for security audits.

claude-in-chrome-troubleshooting

Diagnose and fix Claude MCP Chrome extension connectivity issues.

entry-point-analyzer

Identify and classify state-changing entry points in smart contracts.

semgrep-rule-creator

Create Semgrep rules with test-first validation and structured metadata.

constant-time-analysis

Detect timing side-channel vulnerabilities in cryptographic code and output CI-ready JSON results.

property-based-testing

Design property-based test strategies and review workflows across multiple languages.

differential-review

Analyze security-focused git diffs and generate markdown audit reports.

insecure-defaults

Detect insecure default configurations with hardcoded secrets and weak authentication.

yara-rule-authoring

Validate YARA-X rule syntax, metadata, and atom quality with linting.

Official

Advanced

Frequently Asked Questions

FAQPage Schema

How to install Trail of Bits skills?▼

Run `npx skills add trailofbits/skills --all -g -y` in your terminal to install the full security skill suite globally.

What security tasks can these skills automate?▼

They cover C/C++ and Rust security review, smart contract auditing, Semgrep and CodeQL scanning, mutation testing, supply-chain risk audits, and vulnerability triage with false-positive verification.

Do these skills work with Claude Code and Codex?▼

Yes. The repository is a Claude Code plugin marketplace, and Codex loads it directly through its Claude marketplace compatibility with no extra configuration.

Can AI agents find real vulnerabilities with these skills?▼

Yes. The suite includes measured, multi-agent pipelines like c-review and zeroize-audit that verify coverage against parsed source and require compiler-level evidence before confirming findings.

Do I need security expertise to use these skills?▼

No. Each skill encodes the expert methodology, evidence requirements, and common rationalizations to reject, so your agent applies senior-auditor discipline from plain-English requests.