What it is
Trail of Bits, a security research and audit firm, publishes its skills and plugins for AI-assisted security work as a plugin marketplace for Claude Code and Codex. There are 46 plugins, covering differential review of changes, static analysis that runs CodeQL and Semgrep and reads their SARIF output, variant analysis to find sibling bugs, insecure defaults, supply-chain risk, auditing GitHub Actions that run AI agents, C and C++ review, smart contracts and more.
The repo has no tagged releases and over 2,000 commits; it is updated almost daily. The licence is CC BY-SA 4.0, a share-alike licence.
Our review
Ask a coding agent to "review this for security" and you get a confident list that may or may not be real. Trail of Bits replaces that with methods its auditors use, one skill per job.
The smart design choice is that the strongest skills drive proper tools instead of trusting the model's judgement. The static-analysis skill runs CodeQL and Semgrep and reads their results; variant analysis takes one bug you found and hunts for its siblings across the codebase. Others review a change by its blast radius, check dependencies for abandoned or risky packages, and audit GitHub Actions workflows that run AI agents, a real attack route in 2026.
The catch: it is a big catalogue, and much of it, smart contracts, binaries, Burp Suite files, will not apply to your stack. Install the few you need. The share-alike licence means a modified internal copy may have to stay under the same licence, so check with legal before forking.
Our take: none of these skills prevents anything; they find things. That makes them the right tool before a risky merge, and the wrong thing to rely on as your only control.
Where it earns its place
A backend team of eight before a major auth refactor merges
Review the change for what it could break
Install the differential-review and static-analysis plugins and run them on the branch; costs model usage plus local CodeQL and Semgrep time.
A DevOps engineer with agents in GitHub Actions
Check workflows that run AI agents for injection routes
Install agentic-actions-auditor and run it across .github/workflows.
Before you commit
- Setup
- In Claude Code: /plugin marketplace add trailofbits/skills, then /plugin to pick plugins. Codex: codex plugin marketplace add trailofbits/skills.
- Integrations
- Claude Code and Codex marketplaces; ChatGPT workspace import; drives CodeQL and Semgrep where installed.
- Data and privacy
- Skills run inside your agent, so code goes to whichever model the agent uses. CC BY-SA 4.0.
- Cost at scale
- Free; costs are model usage and CI time for CodeQL or Semgrep runs.
- Limits
- Findings still need a person to confirm; no tagged releases.
What's good
- Methods from a working security audit firm
- Strongest skills drive CodeQL and Semgrep
- Works in Claude Code and Codex
- Covers GitHub Actions agent attacks and supply chain
What's not
- Large catalogue; much is niche
- CC BY-SA share-alike licence complicates internal forks
- No tagged releases to pin
Best for
Teams that want structured, credible security review from their coding agent before risky merges.
Alternatives
Trail of Bits Skills: common questions
- Is Trail of Bits Skills worth it?
- A generic "check for OWASP issues" prompt is a guess; this is how a working audit firm actually looks for bugs, written down for your agent. We rate it 4.4 out of 5.
- How much does Trail of Bits Skills cost?
- Free under CC BY-SA 4.0.
- What are the downsides of Trail of Bits Skills?
- Large catalogue; much is niche; cC BY-SA share-alike licence complicates internal forks; no tagged releases to pin.
- Who is Trail of Bits Skills best for?
- Teams that want structured, credible security review from their coding agent before risky merges.
- How much does Trail of Bits Skills cost for a team or in production?
- Free; costs are model usage and CI time for CodeQL or Semgrep runs.
- Is Trail of Bits Skills safe for company data?
- Skills run inside your agent, so code goes to whichever model the agent uses. CC BY-SA 4.0.
- What are the best Trail of Bits Skills alternatives?
- The closest alternatives we have reviewed are Cloudflare Security Audit Skill and security-guidance plugin (Claude Code).
Answers checked Oct 24, 2026.
Make Trail of Bits Skills? Show this rating on your site
