Skip to content

skills

by trailofbits

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

About

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

6,256
Stars
222
Skill Files
542
Forks
122
PRs Merged
36
Contributors
19
Issues Open
16
Issues Closed
2026-06-30
Last Activity

Skill Analysis

147
Avg Lines / Skill
845
Avg Words / Skill
1078
Code Blocks
1004
Total Files
4.98 MB
Repo Size
162
Reference Files
Skill lines14 min / 62 median / 796 max
Code languagesbash, c, cmake, conf, cpp, dockerfile, func, go, javascript, json, makefile, markdown, mermaid, php, powershell, proverif, python, ruby, rust, scheme, sh, solidity, text, toml, typescript, yaml, yara
Frontmatter keysallowed-tools, argument-hint, color, consolidated, covers, description, disable-model-invocation, gate, kind, model, name, tools, type
Has CLAUDE.mdYes
Has LicenseYes
File typesmd (634), yaml (84), svg (74), json (56), py (54), sh (28), bats (10), toml (9), yml (5), ql (5)

Skills (248)

  • skill-improver
    147 lines893 words4 blocks

    "Iteratively reviews and fixes Claude Code skill quality issues until they meet standards. Runs automated fix-review cycles using the skill-reviewer a...

    text
  • trailofbits:diff-review
    17 lines59 words

    Performs security-focused differential review of code changes

  • adversarial-modeler
    174 lines790 words3 blocks

    "Models attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies high-risk changes that ...

    markdown
  • differential-review
    229 lines1035 words5 blocks

    >

  • devcontainer-setup
    304 lines943 words18 blocks

    Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support ...

    dockerfilejsonmermaid
  • trailmark-summary
    84 lines446 words3 blocks

    "Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvan...

    bash
  • trailmark
    205 lines970 words5 blocks

    "Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privile...

    bashpython
  • genotoxic
    340 lines1761 words7 blocks

    "Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary...

    bashmarkdown
  • diagramming-code
    189 lines814 words10 blocks

    >

    bashmarkdownmermaidpython
  • trailmark-structural
    120 lines529 words3 blocks

    "Runs full Trailmark structural analysis on Trailmark 0.2.x by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius,...

    bash
  • audit-augmentation
    178 lines900 words5 blocks

    >

    bashpython
  • mermaid-to-proverif
    462 lines2634 words16 blocks

    "Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a Pr...

    proverif
  • crypto-protocol-diagram
    441 lines2734 words6 blocks

    "Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and ge...

    bashmarkdown
  • vector-forge
    479 lines2720 words6 blocks

    "Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mut...

    bash
  • graph-evolution
    320 lines1508 words9 blocks

    >

    bashpython
  • 3b-rust-compiler-analyzer
    287 lines1709 words10 blocks

    "Performs crate-level MIR and LLVM IR analysis for Rust in zeroize-audit. A single instance runs per crate (unlike 3-tu-compiler-analyzer which runs o...

    bashjson
  • 6-test-generator
    76 lines416 words

    "Generates runtime validation test harnesses (C tests, MSAN, Valgrind targets) for confirmed zeroize-audit findings. Produces a Makefile for automated...

  • 5-poc-generator
    327 lines2252 words10 blocks

    "Crafts bespoke proof-of-concept programs demonstrating that zeroize-audit findings are exploitable. Reads source code and finding details to generate...

    bashjsonrusttoml
  • 4-report-assembler
    294 lines1812 words5 blocks

    "Collects all findings from source and compiler analysis, applies supersessions and confidence gates, normalizes IDs, and produces a comprehensive mar...

    bashjsonmarkdown
  • 3-tu-compiler-analyzer
    208 lines1071 words8 blocks

    "Performs per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per translation unit, enabling par...

    bashjson

Recent Commits

-322 contributions across all repos
JunJulAugSepOctNovDecJanFebMarAprMayJun
Less
More
  • cfe5d7b2026-06-30
    Rust review plugin (#178)
    Andrea Cappa (zi0Black)
  • 39e10bd2026-06-24
    build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the all group (#191)
    dependabot[bot]
  • ff4162d2026-06-22
    Update fp-check with links and best practices update (#189)
    Jay Little
  • c070b9b2026-06-10
    fix(fp-check): use correct JSON response format in stop hooks (#129)
    jonnydevs
  • 64a8c3f2026-06-10
    Update second-opinion Codex model to gpt-5.5 (#163)
    Matthew Kern
  • 55771192026-06-10
    fix(semgrep-rule-creator): correct 404ing semgrep-docs links (#179)
    Jamie Reid
  • c910ecf2026-06-10
    Bump actions/checkout from 6.0.2 to 6.0.3 in the all group (#182)
    dependabot[bot]
  • d5fe2e62026-06-05
    feat(codex): add UI metadata for skills (#175)
    Lixin2026
  • f09e5c72026-06-05
    Remove legacy codex compatiblity scripts/shims. (#173)
    William Tan
  • c94841b2026-05-27
    Fix for when CLAUDE_PLUGIN_ROOT contains spaces (#169)
    Tim Lander