Skip to content

skills

by trailofbits

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

About

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

4,078
Stars
94
Skill Files
356
Forks
94
PRs Merged
24
Contributors
13
Issues Open
7
Issues Closed
2026-03-27
Last Activity

Skill Analysis

264
Avg Lines / Skill
1,287
Avg Words / Skill
786
Code Blocks
622
Total Files
3.43 MB
Repo Size
138
Reference Files
Skill lines19 min / 259 median / 796 max
Code languagesbash, c, cmake, conf, cpp, dockerfile, func, go, javascript, json, makefile, markdown, mermaid, php, powershell, python, ruby, rust, scheme, sh, solidity, text, toml, typescript, yaml, yara
Frontmatter keysallowed-tools, argument-hint, color, description, disable-model-invocation, model, name, tools, type
Has CLAUDE.mdYes
Has LicenseYes
File typesmd (429), json (49), py (35), sh (29), yaml (10), bats (10), toml (7), yml (5), yar (5), ql (5)

Skills (94)

  • dimension-propagator
    219 lines1405 words4 blocks

    Propagates dimensional annotations through arithmetic and call chains, reporting mismatches found during propagation

    solidity
  • dimension-discoverer
    257 lines1214 words8 blocks

    Discovers dimensional vocabulary for codebases by analyzing naming conventions and protocol patterns

    jsonmarkdownrustsolidity
  • dimension-validator
    422 lines1549 words19 blocks

    Validates dimensional consistency and detects dimensional bugs in annotated code

    jsonmarkdownsoliditytext
  • dimension-annotator
    303 lines1286 words11 blocks

    Adds dimensional annotations to source code at anchor points using Reserve Protocol's format

    solidity
  • arithmetic-scanner
    268 lines1632 words3 blocks

    Scans repo for files with dimensional arithmetic to scope discovery

    json
  • dimensional-analysis
    275 lines2412 words2 blocks

    "Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in...

    jsontext
  • yara-rule-authoring
    646 lines3690 words18 blocks

    >

    bashyara
  • supply-chain-risk-auditor
    68 lines886 words

    "Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health,...

  • trailofbits:ct-check
    21 lines66 words

    Detects timing side-channels in cryptographic code

  • constant-time-analysis
    220 lines1121 words8 blocks

    Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, s...

    bashctext
  • function-analyzer
    141 lines745 words

    "Performs ultra-granular per-function deep analysis for security audit context building. Use when analyzing dense functions, data-flow chains, cryptog...

  • Builds deep architectural context before vulnerability hunting

  • audit-context-building
    303 lines1341 words

    Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

  • devcontainer-setup
    301 lines919 words18 blocks

    Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support ...

    dockerfilejsonmermaid
  • skill-improver
    153 lines899 words4 blocks

    "Iteratively reviews and fixes Claude Code skill quality issues until they meet standards. Runs automated fix-review cycles using the skill-reviewer a...

    text
  • trailofbits:scan-apk
    19 lines55 words

    Scans Android APKs for Firebase security misconfigurations

  • firebase-apk-scanner
    198 lines896 words8 blocks

    Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functio...

    bash
  • modern-python
    334 lines1431 words11 blocks

    Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/my...

    bashmakefiletoml
  • dwarf-expert
    94 lines651 words3 blocks

    Provides expertise for analyzing DWARF debug files and understanding the DWARF debug format/standard (v3-v5). Triggers when understanding DWARF inform...

    bash
  • seatbelt-sandboxer
    314 lines1455 words14 blocks

    "Generates minimal macOS Seatbelt sandbox configurations. Use when sandboxing, isolating, or restricting macOS applications with allowlist-based profi...

    bashscheme

Recent Commits

-331 contributions across all repos
MarAprMayJunJulAugSepOctNovDecJanFebMar
Less
More
  • 4b9a4e92026-03-27
    docs(aflpp): add opinionated environment variables guide (#130)
    Tim Ren
  • 9df47312026-03-25
    add dimensional analysis plugin (#132)
    Benjamin Samuels
  • 5c15f4f2026-03-17
    Add archetype deep profiles to culture-index skill (#126)
    Dan Guido
  • aab484c2026-03-16
    Add Codex-native skill installation support (#123)
    Artem Dinaburg
  • b1f2ed92026-03-16
    Improve skill-improver plugin's ability to locate skill-reviewer (#122)
    Tannr
  • 86559372026-03-16
    Add some improvements to semgrep-rule-creator (#116)
    mschwager
  • c6097692026-03-04
    Fix burpsuite-project-parser skill directory structure (#115)
    Dan Guido
  • 00c013d2026-03-04
    gh-cli: Replace skill with hooks-only enforcement (#114)
    William Tan
  • 19c463e2026-03-03
    Import fp-check plugin from skills-internal (#113)
    Dan Guido
  • 1a868d22026-02-27
    second-opinion: use Codex CLI's built-in MCP server (#110)
    Dan Guido